valoshop[.]lol

The domain valoshop.lol was registered through Web Commerce Communications Limited dba WebNic.cc and first appeared on the DNS on November 15, 2025. It resolves to the IPv4 address 193.187.110.3 and uses three dnspod.com name servers (a.dnspod.com, b.dnspod.com, c.dnspod.com). The domain is currently listed on a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that threat intelligence sources have identified it as malicious.

VirusTotal reports that the domain has been scanned by 91 anti‑malware vendors, and none of those vendors have generated a detection at the time of analysis; the absence of detections does not constitute evidence of benign behavior. The available data classifies the activity as generic phishing, but no further details such as target brand, page title, or specific payload have been disclosed. Because the domain is still marked as active and under investigation, defenders should treat it as a potential phishing vector.

Recommended actions include adding the domain to internal blocklists, configuring web proxies to deny HTTP/HTTPS traffic to valoshop.lol, and monitoring outbound DNS queries for the associated IP address and dnspod.com name servers. Continuous re‑evaluation is advised, as future scans or additional threat feeds may provide more granular indicators of compromise. Organizations should also consider sharing any observed traffic with relevant information‑sharing communities to accelerate detection and response efforts.