h5[.]veloxam[.]io

The domain h5.veloxam.io has been identified as a confirmed phishing site, exhibiting a high-risk threat level. Analysis shows that this domain was created on March 4, 2026, and remains active as of July 12, 2026. The page’s title, 'VAM - VELOX ASSET MANAGEMENT,' suggests an intent to mislead users regarding its legitimacy. The domain holds a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trustworthiness. It has also been flagged by 5 out of 95 security vendors on VirusTotal, further demonstrating its malicious nature. Additionally, it is listed on one known security blocklist and has been actively blocked by PhishDestroy.

The domain is registered through HOSTINGER operations, UAB, which may signify a potential trend in malicious domain registrations utilizing this service. Infrastructure analysis reveals that the site employs technologies such as Vue.js, HSTS, and is hosted behind Cloudflare, which is often used to conceal the true origin of malicious actors. Furthermore, the presence of HTTP/3 suggests an attempt to optimize the site's performance, which can attract unwary users. The domain resolves to the IP address 104.21.4.121, which is a known tactic for phishing sites to obscure their actual hosting environment.

Defenders are urged to implement blocking measures for this domain and remain vigilant for any phishing attempts that may be linked to it. Given the active status and the identified phishing elements, users should be educated on the risks of engaging with such domains. Continuous monitoring and updating of blocklists will be essential in mitigating the risks posed by domains like h5.veloxam.io.