velorafondsai[.]live

Analysis of velorafondsai.live indicates a high-risk phishing domain targeting users through a fraudulent AI-assisted trading platform. The domain, registered on May 11, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP address 104.21.25.140 and is actively proxied through Cloudflare, a common tactic to obscure hosting origins and evade takedowns. The page title, 'Velorafonds AI | Official Platform for AI Assisted Trading,' suggests an attempt to impersonate a legitimate investment service, though no confirmed brand association has been established beyond the self-declared branding. Infrastructure analysis reveals the use of content delivery networks (Unpkg, jsDelivr) and third-party libraries (jQuery, IPinfo), which are frequently exploited in phishing campaigns to load malicious scripts or exfiltrate user data. The domain is flagged by 16 threat intelligence pulses on AlienVault OTX and appears on two security blocklists, including PhishDestroy and BLP-Malware. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. The SSL certificate, issued by Let's Encrypt, is standard for both legitimate and fraudulent sites and does not mitigate the threat. Defenders should treat this domain as active and high-risk. The combination of recent registration, Cloudflare proxying, and confirmed blocklist presence aligns with known phishing infrastructure patterns. While the exact content and payload remain unanalyzed, the domain's intent appears to be financial fraud under the guise of AI-driven trading. Network-level blocking and monitoring of associated IP ranges (104.21.25.0/24) are recommended to disrupt potential user interactions.