admin[.]www[.]cpanel[.]non-steam[.]com

Analysis of admin.www.cpanel.non-steam.com shows that the domain is currently active and was originally registered on August 23, 2019 through Danesco Trading Ltd. The authoritative nameservers are ian.ns.cloudflare.com and rita.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. DNS resolution points to the single IPv4 address 81.91.178.184, which continues to host the site. The domain appears on one security blocklist and has been listed by the PhishDestroy blocklist, confirming prior detection. VirusTotal data reports that eight of ninety‑five scanning engines have issued a malicious verdict for the domain, reinforcing the suspicion of abusive use. The available intelligence does not include Safe Browsing, Open Threat Exchange, SSL certificate details, or HTTP response codes, so those surfaces remain unverified. Nonetheless, the combination of a recent blocklist entry, multiple vendor detections, and the use of a Cloudflare fronting service aligns with patterns observed in generic phishing infrastructure that leverages reputable DNS providers to obscure origin. The presence of a single hosting IP suggests a low‑cost or compromised server rather than a distributed network. Defenders should add admin.www.cpanel.non-steam.com and its resolved IP 81.91.178.184 to inbound and outbound filtering rules, enforce DNS‑based blocklisting, and monitor for any new resolution changes. Continuous re‑scanning with VirusTotal and other multi‑engine platforms is advised to capture any escalation in detection counts. Because the domain’s content has not been publicly examined, analysts should treat any user‑submitted URLs pointing to this host as potentially malicious and isolate them pending further forensic analysis.