valorez[.]pro

Analysis of valorez.pro confirms it as an active phishing domain targeting Microsoft 365 credentials, first registered on June 22, 2026, through registrar Global Domain Group LLC. The domain currently resolves to IP address 192.162.199.233 and is served by Cloudflare nameservers lewis.ns.cloudflare.com and zariyah.ns.cloudflare.com, a common infrastructure choice for threat actors seeking to obscure hosting origins. As of July 31, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy, indicating confirmed malicious activity. VirusTotal telemetry shows 7 of 91 security vendors flagging valorez.pro, providing further evidence of its phishing classification.

Infrastructure analysis reveals no legitimate business association or historical web presence. The domain's recent creation, combined with its immediate appearance on blocklists, suggests a disposable phishing asset rather than a repurposed legitimate site. While the exact phishing kit or brand impersonation is not yet confirmed through page content analysis, the domain's naming convention and detection context strongly indicate a focus on corporate credential theft.

Defenders should treat this domain as high-risk and implement immediate blocking at DNS, proxy, and endpoint layers. Security teams are advised to monitor for connections to 192.162.199.233 and correlate any internal access attempts with potential credential compromise events. Given the domain's continued active status, ongoing monitoring of related infrastructure and newly registered lookalike domains is recommended.