velnixpay[.]xyz

The domain velnixpay.xyz was registered on July 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Its authoritative name servers are carioca.ns.cloudflare.com and oswald.ns.cloudflare.com, indicating the use of Cloudflare's DNS service. DNS resolution returns a single A record pointing to 188.114.96.3, an IP address that is currently associated with multiple malicious observations in open‑source feeds. The domain appears on one public security blocklist and is listed as blocked by the PhishDestroy feed, confirming that at least one defensive feed has categorized it as malicious.

VirusTotal analysis shows that 1 of 91 scanned security vendors flagged the domain, providing an independent detection signal. No additional reputation scores, Safe Browsing status, or SSL certificate details are available in the supplied data. Given the recent registration date, the use of Cloudflare infrastructure, and the presence on a phishing‑oriented blocklist, the domain is assessed as high‑risk for generic phishing campaigns. The specific phishing content, target brand, or page characteristics have not been disclosed, so the exact lure employed by the site remains unknown.

Defenders should immediately add velnixpay.xyz to network‑level deny lists and DNS filtering policies. Continuous monitoring of the IP address 188.114.96.3 for new malicious activity is advised, as the host may serve additional payloads or be reused for future campaigns. Organizations using threat‑intelligence platforms should ingest the PhishDestroy indicator and the single VirusTotal detection to enrich their detection rules. Because the domain is still active, periodic re‑query of VirusTotal and public blocklists is recommended to capture any escalation in detection counts or additional attribution.