veloxam[.]org

On 28 July 2026 analysts observed that the domain veloxam.org is actively leveraged in a high‑risk generic phishing campaign. The domain was registered on 3 March 2026 through HOSTINGER operations, UAB and is currently hosted on Cloudflare’s network, resolving to the IPv4 address 172.67.135.72, which is geolocated to Canada. The authoritative name servers eugene.ns.cloudflare.com and suzanne.ns.cloudflare.com confirm the use of Cloudflare’s DNS service.

VirusTotal reports that one out of ninety‑one scanned security vendors flagged the domain, indicating at least one detection of malicious activity. Independent phishing‑filtering services PhishDestroy, MetaMask and SEAL have already added veloxam.org to their blocklists, and the domain appears on three additional security blocklists, further corroborating its abusive nature. The combination of recent registration, Cloudflare‑based hosting, and early detection by multiple vendors suggests a purpose‑built phishing infrastructure rather than a compromised legitimate site.

However, no public samples of the delivered payload, page title, or TLS certificate details have been released, leaving the exact phishing vector and targeted brands undefined. Defenders should proactively block traffic to the domain at perimeter firewalls, update DNS filtering policies to include the observed name servers, and monitor for any resolution of the 172.67.135.72 address in outbound connections. Continuous re‑evaluation of VirusTotal and other sandbox analyses is advised, as additional detections may emerge as the campaign evolves.