steam[.]bywg[.]vip

The domain steam.bywg.vip was identified by PhishDestroy as a high-risk brand impersonation threat specifically targeting Steam, the popular gaming platform. This phishing domain was designed to mimic the official Steam Community page, as indicated by its page title 'Steam-Community', and likely aimed to harvest user credentials or other sensitive information. No specific drainer kit was associated with this domain in the available intelligence.

Technical indicators from the investigation reveal that steam.bywg.vip was flagged by 22 out of 95 security vendors on VirusTotal, indicating a consensus among security engines that this is a malicious site. The domain was created on June 16, 2021, and registered through DNSPod, Inc. It resolves to IP address 43.159.199.58 and uses an SSL certificate issued by Let's Encrypt (R11), which is commonly abused by phishing sites. Google Safe Browsing also flagged the domain as phishing, and it appeared on at least 2 security blocklists, further corroborating its malicious intent.

As of the latest intelligence, steam.bywg.vip is offline, meaning it is no longer accessible. However, the domain remains a threat as it could be reactivated or used for future campaigns. Users who may have interacted with this site are advised to change their Steam passwords and enable two-factor authentication immediately. PhishDestroy continues to monitor for similar threats and recommends that all users verify the legitimacy of any site claiming to be a brand they trust before entering credentials.