tenzroll[.]skin

Analysis of the domain tenzroll.skin indicates a brand impersonation campaign targeting Phantom, a known entity associated with the VALORANT gaming ecosystem. The domain was registered on December 12, 2025, through Dynadot LLC and currently resolves to the IP address 104.21.43.198, hosted on Cloudflare's infrastructure (AS13335, United States). Nameservers are configured as arvind.ns.cloudflare.com and cecelia.ns.cloudflare.com, a common pattern for domains leveraging Cloudflare's services to obscure origin servers. The domain lacks an SSL certificate, which is atypical for legitimate gaming or brand-affiliated sites but consistent with low-effort phishing operations. Detection metrics reveal moderate but notable concern: the domain appears on one security blocklist (PhishDestroy) and is flagged by 12 of 93 security vendors on VirusTotal.

AlienVault OTX records the domain in two threat intelligence pulses, suggesting prior observation in malicious contexts. Gridinsoft assigns a trust score of 0/100, further corroborating its classification as high-risk. The page title, 'VALORANT x TENZ - Free Skin Roulette,' explicitly references VALORANT and a free skin giveaway, a tactic commonly used to lure users into credential harvesting or malware distribution schemes. No evidence confirms the specific payload or post-compromise behavior, as the domain is currently offline. Defenders should prioritize this domain for blocking at the DNS and network layers, particularly in environments frequented by gaming communities.

The use of Cloudflare nameservers and IP space does not inherently indicate malicious hosting but complicates origin tracing. Given the domain's registration age (over seven months) and its appearance on multiple detection platforms, it is unlikely to be a short-lived campaign. Organizations should monitor for related domains registered through Dynadot or resolving to the same IP, as threat actors often reuse infrastructure.