valomart[.]shop

On July 31, 2026 the domain valomart.shop was observed to be actively used in a generic phishing campaign. The domain resolves to the IPv4 address 158.94.211.169 and is served from DNS infrastructure operated by DNSPod, as indicated by the three authoritative name servers a.dnspod.com, b.dnspod.com and c.dnspod.com. The domain is currently listed on one public security blocklist and has been added to the PhishDestroy blocklist, confirming that at least one external mitigation service is actively denying traffic to it. VirusTotal analysis shows that five of ninety‑one scanned security vendors returned a positive detection, which reinforces the suspicion that the site hosts malicious content.

No additional intelligence such as SSL certificate details, HTTP response codes, page title, or brand targeting was provided, so the precise appearance of the phishing page remains unknown. The limited detection footprint suggests that the campaign may be in an early stage or employing a low‑profile hosting arrangement. Defenders should block DNS resolution for valomart.shop at the network perimeter, add the domain to URL filtering policies, and monitor outbound connections to the associated IP address 158.94.211.169.

Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture any changes in payload or hosting. Because the domain is still active, threat‑hunting queries that match the domain or its name‑server pattern may uncover related malicious infrastructure. Organizations that have observed credential‑phishing attempts should verify whether any user‑submitted URLs correspond to this domain and treat any credential submissions as compromised.