riotgames[.]ws

Analysis of riotgames.ws indicates an active malicious infrastructure supporting a generic phishing campaign. The domain resolves to IP 91.92.243.12 and returns HTTP 200 with the page title "Loading," suggesting a placeholder or redirect page commonly used in credential harvesting. Registration data shows the domain was created on March 12, 2026 through Global Domain Group LLC and is delegated to Cloudflare nameservers hassan.ns.cloudflare.com and tess.ns.cloudflare.com, providing anonymity and resilience. VirusTotal scans reveal that three of ninety‑five security vendors have flagged the domain, adding independent corroboration of malicious intent. While the specific payload or credential collection mechanism has not been observed, the combination of recent registration, active hosting, and multiple vendor detections constitutes strong evidence of a phishing operation. Defenders should block network resolution to 91.92.243.12, add riotgames.ws to URL filtering and domain block lists, and monitor for related traffic patterns. Incident response teams should also review logs for any attempted connections from internal hosts to this domain and advise users to avoid any unsolicited communications referencing Riot Games credentials.