velodromex[.]xyz

Analysis indicates that the domain velodromex.xyz was registered through NiceNIC International Group Co., Limited on October 16, 2025. The domain resolves to the IP address 172.67.189.98, which is hosted by Cloudflare (AS13335) in the United States. No TLS certificate is presented, leaving the HTTP service unencrypted. The hosting infrastructure is shared, as reflected by the generic Cloudflare nameservers achiel.ns.cloudflare.com and erin.ns.cloudflare.com.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already listed the domain as malicious, and VirusTotal reports that 12 of 95 scanned security vendors flag the host as suspicious. The current operational status is offline, indicating that the site has been taken down or is otherwise inaccessible. Defenders should immediately block connections to 172.67.189.98 at the network perimeter and add velodromex.xyz to internal URL filtering and DNS sinkhole lists.

Continuous monitoring of Cloudflare‑hosted IP ranges for re‑registration of similar domains is recommended, as the attacker may reuse the same infrastructure. Because the domain lacks an SSL certificate, any attempt to serve content over HTTPS would trigger certificate errors, which can be used as an additional detection cue. Correlation with other recent phishing indicators that share the same registrar or nameserver pattern may help uncover related campaigns. Until the domain reappears, threat intelligence feeds should retain the current blocklist entries, and security operations should validate that existing email and web filtering solutions correctly flag the domain as elevated risk.