prrt1steamlocomotivetrust[.]org

Analysis as of July 25, 2026 indicates that the domain prrt1steamlocomotivetrust.org is actively hosting a site titled “The T1 Trust”. The page title and the description of the threat list the brand target as Steam and classify the operation as a gaming‑related scam. The domain was registered on February 21, 2026 through Squarespace Domains II LLC and uses the nameservers ns1.hivelocity.net and ns2.hivelocity.net, which resolve to the IP address 23.227.187.229 owned by HIVELOCITY, Inc. (AS29802) in the United States. The site serves content over HTTPS with a Let’s Encrypt certificate (R13). An HTTP request returns a 200 status code, confirming that the web service is reachable.

Infrastructure fingerprints show a typical WordPress stack: WordPress, MySQL, PHP, ZURB Foundation, LiteSpeed, jQuery and embedded YouTube and Stripe components. These technologies are consistent with a publicly facing e‑commerce or donation page, but no further functional analysis is available. The domain appears on a single security blocklist and has been flagged by PhishDestroy, indicating that at least one anti‑phishing service has taken action against it. Gridinsoft assigns a trust score of 0 / 100, reflecting a highly suspicious reputation. The file was submitted to VirusTotal where 93 scanning engines evaluated the content; none reported a detection at the time of analysis.

While the lack of detections does not constitute proof of safety, it does confirm that no known malware signatures were identified during that scan. Uncertainty remains regarding the exact content of the landing page, the presence of credential‑harvesting forms, or any malicious payloads beyond the branding abuse. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any associated traffic to the hosting IP. Users of the Steam platform should be warned that any communications or offers originating from prrt1steamlocomotivetrust.