valday[.]top

The domain valday.top has been identified as a platform involved in credential theft phishing. This specific type of threat is designed to trick users into providing sensitive information, such as usernames, passwords, and other authentication credentials, which can then be used for unauthorized access to accounts or systems. The domain does not appear to be associated with any particular brand or drainer kit, but the risk level is elevated due to its involvement in phishing activities.

Infrastructure analysis reveals that valday.top has a VirusTotal detection score of 11/95, indicating that a significant portion of security vendors recognize the domain as malicious. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 91.227.114.14. It was created on May 20, 2026, and currently appears on one security blocklist, with a Gridinsoft trust score of 0/100, further emphasizing its untrustworthy nature. Additionally, the domain is blocked by the security solution PhishDestroy.

As of the latest assessment, valday.top is offline, which reduces the immediate risk of exposure to potential victims. However, the domain's history and technical indicators suggest that it has been actively used for malicious purposes. Security researchers and network administrators are advised to maintain vigilant monitoring for any signs of the domain being reactivated. Users should avoid accessing the domain and report any instances of it appearing in communications or search results to their security team. The offline status does not guarantee complete risk mitigation, as the threat actors may re-register or use similar domains to continue their campaigns.