ent[.]mobswatch[.]top

The domain ent.mobswatch.top was registered on 21 February 2026 through Web Commerce Communications Limited. Its authoritative nameservers are christian.ns.cloudflare.com and sima.ns.cloudflare.com, and DNS resolution points to IP address 104.21.31.204, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The TLS certificate presented is identified as “WE1”, indicating a generic Cloudflare‑issued certificate rather than a brand‑validated credential. Analysis by VirusTotal shows that 13 of 93 scanning engines flagged the host as malicious, and the domain appears on a single external blocklist.

PhishDestroy has already taken the site offline, and current network probes report no active HTTP service. The site’s page title is “Anmelden”, a German term for “login”, and the listed brand target is Steam. Combined with the classification “Gaming Scam”, the evidence points to a credential‑stealing operation that attempts to lure Steam users into submitting login information. No visual or content capture is available because the site is offline, so the exact phishing layout cannot be confirmed.

Nevertheless, the presence of a Steam‑related brand target, the German login title, and the vendor detection count provide sufficient context for defensive actions. Defenders should add ent.mobswatch.top to URL filtering and firewall block lists, monitor traffic to the associated Cloudflare IP range for similar patterns, and alert end users about unsolicited Steam‑related login prompts, especially those using German language cues. Continuous monitoring of newly registered domains using the same registrar or similar naming patterns is recommended to pre‑empt future impersonation attempts. Attribution of the operators remains unknown, and further investigation of the hosting account may yield additional intelligence.