velodomefi[.]win

Analysis as of July 24 2026 indicates that the domain velodomefi.win has been taken offline but retains evidence of a brand‑impersonation campaign targeting the Velodrome brand. The domain was registered on February 21 2026 and resolves to the IP address 51.222.162.111, which belongs to AS16276 operated by OVH SAS in Canada. The hosting provider and geographic location are consistent with other recent fraudulent infrastructure. The site presented the page title “Velodrome on Optimist – The Velodrome is here”, which directly references the legitimate brand and suggests an attempt to lure victims.

Security telemetry shows that two of ninety‑three vendors on VirusTotal flagged the domain, and the domain appears on the PhishDestroy and ScamSniffer blocklists. Additional reputation services assign very low trust scores: Scamadviser 8/100 and Gridinsoft 0/100, reinforcing the malicious assessment. The SSL certificate in use is identified as “R11”, indicating a self‑signed or otherwise suspicious certificate, a common characteristic of fraudulent sites. Evidence confirms the domain’s classification as a crypto‑related scam, although the exact mechanics of the scam have not been publicly disclosed.

Because the site is currently offline, active payloads cannot be observed, and the specific phishing kit or payment collection methods remain unknown. Defenders should continue to block any DNS resolution attempts for velodomefi.win, enforce URL filtering on the listed blocklists, and monitor for additional domains that resolve to the same OVH IP range. Threat hunting should include correlation of outbound traffic to 51.222.162.111 and inspection of any credential or cryptocurrency wallet data that may be exfiltrated by related campaigns. Until the domain is definitively taken down, it should be treated as a high‑confidence malicious indicator.