login[.]steampowered[.]com[.]ru

login.steampowered.com.ru is a deceptive domain engineered to impersonate the official Steam login portal at steamcommunity.com, harvesting user credentials through a credential-phishing campaign. This fraudulent site mimics Valve Corporation’s branding to trick visitors into entering their Steam account details, which are then harvested by attackers for account takeover or sold on dark web markets. No advanced drainer kit has been observed; the threat relies solely on social engineering and domain spoofing to deceive users.

PhishDestroy identifies this domain as a high-efficiency phishing vector with multiple concrete red flags. VirusTotal reports a detection score of 10 out of 95 security vendors (as of seed b45934), indicating partial but not universal recognition of the threat. The domain resolves to IP address 188.114.97.3, hosted on infrastructure linked to malicious activity. Registered through an anonymous registrar, the domain is newly created and lacks a Google Safe Browsing (GSB) entry. It is currently listed on 0 public blocklists, suggesting rapid deployment and low historical exposure.

This domain remains actively accessible and constitutes an elevated risk to users. PhishDestroy has flagged and blocked login.steampowered.com.ru with real-time proactive detection. Users who access this site are strongly advised to rotate Steam credentials immediately and enable two-factor authentication. While the immediate threat is mitigated, the risk persists due to the ease of registering similar domains and ongoing phishing campaigns leveraging Steam’s trusted brand. Remain vigilant and verify any Steam login links using PhishDestroy before entering credentials.