valoq[.]at

Analysis indicates that the domain valoq.at was registered on 2026-04-07 and resolves to the IP address 186.2.171.13, which is hosted by Iqweb LLC in Belize. The authoritative nameservers are ns01.serverspace.io and ns02.serverspace.io. The site presents a page titled “VALORANT VCT Champions Giveaway” and is classified as a fake‑airdrop campaign that impersonates the brand “phantom”. The infrastructure uses a Let’s Encrypt certificate (R13) and returns HTTP 200 for requests. VirusTotal scans show that 22 of 94 security vendors flag the domain as malicious. The domain is currently listed on one security blocklist and is blocked by the PhishDestroy sinkhole. Independent analysis assigns a Gridinsoft trust score of 11 / 100, reflecting a high likelihood of malicious intent. The phishing kit is identified as a “Giveaway Scam”. No additional page content has been captured, so the exact credential‑collection mechanisms remain unknown. Defenders should consider adding valoq.at to existing URL filtering and DNS block lists, monitor for traffic to 186.2.171.13, and enforce TLS inspection to detect the Let’s Encrypt certificate. Incident response teams should treat any user interaction with the domain as potentially compromised and advise users to delete any credentials entered. Ongoing monitoring of the associated nameservers and the Iqweb LLC hosting provider is recommended to detect future re‑use of the infrastructure.