valorant-santiago[.]lat

On 24 July 2026, the domain valorant-santiago.lat was observed producing an HTTP 522 timeout response while hosted behind Cloudflare's network (IP 104.21.94.237, located in Canada). The domain was registered on 22 March 2026 through Global Domain Group LLC and uses the Cloudflare nameservers damiete.ns.cloudflare.com and sharon.ns.cloudflare.com. No TLS certificate is presented, indicating the site is served over plain HTTP. The page title returned by the server is “valorant-santiago.lat | 522: Connection timed out”, providing no content for analysis. Infrastructure analysis shows reliance on Cloudflare and HTTP/3, a common choice for fast‑flux or disposable phishing sites.

The lack of an SSL certificate and the timeout status suggest the site has been taken offline, either by the operators or by takedown actions. The domain has a Gridinsoft trust score of 0/100 and is listed on a single security blocklist. VirusTotal scans reported three detections out of ninety‑four vendors, confirming that at least a few security products consider the domain malicious. The scam type is identified as a gaming scam, specifically targeting players of Riot Games’ Valorant title.

PhishDestroy has already blocked the domain, reinforcing the assessment that it was used for credential harvesting or fraudulent offers related to the game. Because the site is currently inaccessible, direct observation of malicious payloads or phishing pages is not possible, leaving the exact tactics and lure mechanisms unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any future re‑registration of similar sub‑domains, and educate users about unsolicited Valorant‑related communications. Threat‑intel feeds should be updated to include the domain and its associated IP address, and any logs showing connections to 104.21.94.237 should be investigated for potential compromise attempts.