velmora-live[.]store

Analysis indicates that velmora-live.store was actively serving a phishing page titled “Velmora — Mulai Aktivitas • Naik Level • Tarik Hasil” before being taken offline. The domain resolves to the IPv4 address 178.128.90.186, which is hosted in Singapore by DigitalOcean. Registration details show the hosting provider as DigitalOcean, and the authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com. The site employed a Let’s Encrypt TLS certificate, confirming the use of HTTPS, and the web server was identified as Nginx delivering content over HTTP/3. Front‑end libraries detected include Bootstrap, as well as external resources from Unpkg and jsDelivr, indicating a reliance on third‑party CDNs for JavaScript assets.

VirusTotal recorded a single malicious flag out of 94 scanning engines, demonstrating that at least one security vendor classified the domain as malicious. The domain is listed on one public security blocklist and has been added to the PhishDestroy blocklist, reinforcing its reputation as a phishing infrastructure. No additional detections from Safe Browsing or other reputation services were observed in the available data. The limited intelligence does not reveal the specific credential‑stealing payload, target audience, or any associated command‑and‑control infrastructure.

Consequently, the precise scope of the campaign remains uncertain. Defenders should continue to block both the domain and the associated IP address at perimeter defenses, update DNS filtering policies to include the listed blocklist entries, and monitor for any future re‑registration of the domain or usage of the same IP range. Ongoing surveillance of DigitalOcean‑hosted assets in the Singapore region is recommended, as the provider has been used for other malicious campaigns. Incident response teams should also consider retrieving archived copies of the site via web archives to aid in forensic analysis.