Analysis of the domain valor-skins.com shows that it was registered on July 06, 2026 through the registrar TUCOWS.COM, CO. The domain resolves to the IP address 158.94.211.169 and is served by the DNS provider DNSPod, as indicated by the three authoritative nameservers a.dnspod.com, b.dnspod.com and c.dnspod.com. The infrastructure is currently active and has been observed on a single security blocklist, with PhishDestroy explicitly blocking the domain.
A VirusTotal scan was performed by 91 AV vendors; none of the engines reported a detection, but the absence of a flag does not constitute assurance of benign intent. No additional intelligence such as page titles, brand targeting, SSL certificate details, or HTTP response codes is presently available, leaving the exact phishing payload and the targeted brand undefined. Defenders should treat the domain as a high‑risk indicator given its recent creation, active status, and inclusion on a phishing‑focused blocklist.
Recommended mitigation steps include adding the IP 158.94.211.169 and the domain itself to outbound and inbound filtering rules, monitoring DNS queries for the associated dnspod nameservers, and ensuring that any user‑facing authentication portals are protected by multi‑factor authentication and URL verification controls. Continuous re‑scanning on platforms such as VirusTotal and periodic checks against emerging blocklists are advised to capture any future changes in the domain’s behavior.