steam[.]mmosvc[.]com

steam.mmosvc.com is an active domain that masquerades as the legitimate Steam service. The site presents the page title “Steam Signature Card Generator,” indicating an attempt to lure Steam users into providing personal data or generating fraudulent signature cards. The domain was registered on April 14, 2016 through Spaceship, Inc., and the brand target is explicitly listed as Steam.

The domain resolves to the IP address 138.201.23.52, which geolocates to Germany and belongs to ASN 24940 operated by Hetzner Online GmbH. DNS resolution is handled by the Cloudflare nameservers carrera.ns.cloudflare.com and cris.ns.cloudflare.com. The site serves an HTTPS certificate issued by Let’s Encrypt (R13) and returns an HTTP 303 status code. Underlying web technology analysis identifies Nginx as the web server and jQuery as a client‑side library.

Reputation data shows a Gridinsoft trust score of 0 out of 100, and the domain is currently listed on one public security blocklist. PhishDestroy has already blocked the site, and VirusTotal scans record 15 out of 95 security vendors flagging the domain as malicious. The risk level is classified as high, and the domain remains active as of the report date.

Analysts should add steam.mmosvc.com to deny‑list filters for DNS, web proxy, and endpoint protection solutions. Continuous monitoring of the associated IP range and the Cloudflare nameserver pair is advised, as they may be reused for additional malicious actors. Because the page content has not been captured, further sandbox analysis is recommended to confirm the payload and any credential‑ harvesting mechanisms. Coordination with threat‑intel sharing platforms can help propagate this indicator to broader defenses.