1703351226[.]dojiner[.]at

Analysis of 1703351226.dojiner.at, created on February 21, 2026, shows that the domain is currently offline but was previously associated with a high‑risk gaming scam targeting Steam users. The site presented a page titled "Sign In," a common indicator of credential‑harvesting attempts. The domain resolves to IP address 62.60.226.105, located in Germany and registered to AS214351 FEMO IT SOLUTIONS LIMITED. Hosting is behind Cloudflare, as indicated by the authoritative nameservers arely.ns.cloudflare.com and lou.ns.cloudflare.com.

The TLS certificate is issued by Let’s Encrypt (R12), providing HTTPS with HSTS, but the certificate alone does not mitigate the malicious intent. Detection signals are strong: the domain appears on one security blocklist, is blocked by PhishDestroy, and Google Safe Browsing flags it for social engineering. VirusTotal recorded 23 detections out of 93 scanned security vendors, reinforcing the malicious classification. Additionally, Gridinsoft assigned a trust score of 0 out of 100, indicating a lack of credibility.

The web stack identified Nginx, OpenResty, and HSTS, which are consistent with many phishing infrastructures but do not provide further attribution. While the site is offline, defenders should continue to block the domain and its associated IP address at perimeter and proxy layers, monitor for any re‑registration attempts, and update phishing detection rules to include the observed page title and SSL fingerprint. Ongoing threat‑intel feeds should be queried for any resurgence of the infrastructure, and security teams should educate users about unsolicited Steam login prompts to reduce the success rate of similar impersonation campaigns.