valorantenz[.]top

This domain, valorantenz.top, is flagged for brand impersonation targeting the Phantom brand, a component of a known credential harvesting campaign. Analysis indicates the site mimics official Valorant branding, as evidenced by the page title "Valorant," suggesting an intent to deceive users into disclosing login credentials or other sensitive information. No drainer kit signatures were identified in initial scans, though further forensic analysis may reveal additional malicious payloads or scripts. Infrastructure analysis reveals the domain was registered on December 04, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.130.10, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain lacks an SSL certificate, increasing the likelihood of interception of unencrypted traffic. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. No detections were recorded in Google Safe Browsing at the time of analysis. The domain is currently offline, mitigating immediate risk to end users. However, the infrastructure remains registered and could be reactivated. Response actions include monitoring for re-emergence, blocking the IP and domain at network perimeters, and alerting affected brand stakeholders. Remaining risk includes potential reuse of the domain or IP for future campaigns, necessitating continued vigilance and proactive threat intelligence sharing.