val-the[.]com

Analysis of val-the.com indicates that the domain was registered on December 4, 2025 through MAT BAO CORPORATION and is hosted on IP 186.2.171.13, which belongs to ASN 59692 (IQWeb FZ-LLC) located in Belize. The domain resolves to this IP and uses Google Cloud DNS nameservers ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com, and ns-cloud-d3.googledomains.com. No TLS certificate is presented, meaning HTTPS connections are not available. The only visible attribute is the page title “Valorant Skins Drop,” which aligns with a brand‑impersonation campaign targeting Riot Games. VirusTotal scans have recorded 10 positive detections out of 93 security vendors, indicating that a subset of scanners have identified malicious characteristics.

Gridinsoft assigns a trust score of 0 out of 100, reinforcing the perception of high risk. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service recognises it as hostile. No Safe Browsing or OTX entries are publicly referenced for this domain. The current status is taken offline, but the hosting provider and IP remain active, so the infrastructure could be re‑used. The exact content served at the URL has not been captured; therefore the presence of credential‑stealing forms or additional redirect chains cannot be confirmed.

Defenders should continue to block the domain and the associated IP address at perimeter and DNS layers. Monitoring of ASN 59692 for new domains that resolve to the same IP range is advised. Organizations that rely on Riot Games services should educate users about unsolicited offers for Valorant skins and enforce multi‑factor authentication on any account portals. Incident response teams should treat any traffic to val-the.com as malicious.