valrun[.]net

valrun.net has been observed delivering a high‑risk phishing campaign since its creation on 9 May 2026. The site returns HTTP 200 responses and presents a generic “Loading” page title, a pattern commonly used to mask malicious intent while the victim’s browser resolves the content. The domain is actively listed on at least one security blocklist and is flagged by PhishDestroy, indicating ongoing abuse. The hosting infrastructure points to IP address 51.89.50.14, which resolves to a server in Great Britain operated by OVH GmbH. DNS resolution is provided by Cloudflare, using the authoritative nameservers hassan.ns.cloudflare.com and tess.ns.cloudflare.com. The site serves a valid Let’s Encrypt certificate (R13), thereby gaining browser trust. Mail exchange is directed to mail.hotwall.app (priority 10), suggesting an attempt to imitate services associated with the Hotwall brand. Threat intelligence sources corroborate malicious activity: four of ninety‑five VirusTotal scanners have flagged the domain, and an AlienVault OTX pulse links it to a known phishing indicator set. Gridinsoft assigns a trust score of 0 / 100, reinforcing the assessment of high risk. The limited detection history—only one blocklist entry—implies the campaign may be recent but already sufficiently active to attract defensive attention. Defenders should proactively block traffic to 51.89.50.14 and to the domain valrun.net at the network perimeter. Email gateways ought to reject or quarantine messages routed to mail.hotwall.app from this source, and security teams should monitor for the “Loading” page title in web traffic logs. Continuous re‑evaluation of the domain’s status is advised, as the infrastructure could be repurposed for additional phishing vectors.