valopaff[.]cc

This domain, valopaff.cc, is flagged as an elevated-risk phishing site specifically targeting users of the VALORANT gaming platform. Analysis indicates the infrastructure was designed to impersonate official VALORANT promotions, likely distributing fake limited-time rewards or account recovery scams to harvest login credentials. The threat type is classified as gaming credential phishing, a specialized subset of phishing that exploits in-game economies and player trust. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on April 05, 2026, through Global Domain Group LLC, and resolves to IP address 186.2.171.13, hosted by Iqweb LLC in Belize (BZ). VirusTotal detections show 20 out of 95 security vendors flagging the domain as malicious, while it appears on at least one security blocklist and is currently listed as offline. The site used a Let's Encrypt SSL certificate (R12) and displayed the page title 'VALORANT Limited,' further suggesting an attempt to mimic legitimate VALORANT branding. The creation date, combined with the rapid detection by security vendors, indicates a short-lived but high-impact campaign. Mitigation steps for this threat type include immediate domain blocking at the network and endpoint levels, particularly in environments with gaming-related user activity. Organizations should monitor for credential reuse attempts, as harvested VALORANT accounts are frequently leveraged in secondary fraud schemes. Users who interacted with the domain should reset their VALORANT and associated email credentials, enable multi-factor authentication, and review account activity for unauthorized transactions or in-game purchases. Security teams are advised to correlate this domain with other VALORANT-themed phishing infrastructure using the IP address 186.2.171.13 and registrar Global Domain Group LLC as pivot points for further investigation.