steanmcomnnumity[.]ru

This domain, steanmcomnnumity.ru, is flagged as a high-risk generic phishing site targeting users of the Steam gaming platform. Analysis indicates the domain is designed to mimic legitimate Steam login pages, likely deploying a credential harvester or drainer kit to steal account credentials, payment details, or session tokens. The absence of branding consistency in the domain name (e.g., misspellings like 'steanmcomnnumity') suggests an attempt to evade detection while exploiting user inattention during login attempts. No specific drainer kit has been conclusively linked to this domain at the time of analysis, but its infrastructure aligns with common phishing toolkits used in credential theft campaigns. Infrastructure analysis reveals critical technical indicators associated with steanmcomnnumity.ru. The domain currently resolves to IP address 62.60.226.105, hosted under AS214351 (FEMO IT SOLUTIONS LIMITED) in Germany. It was registered on May 15, 2026, through REGRU-RU, a registrar frequently associated with malicious domains. VirusTotal reports a detection ratio of 1/95 security vendors, indicating limited but present flagging of the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Notably, the domain lacks an SSL certificate, a red flag for users expecting encrypted connections during login attempts. Google Safe Browsing (GSB) status is not explicitly provided, but the domain's presence on a blocklist suggests it may be under review or already flagged. As of the latest assessment, steanmcomnnumity.ru remains active, posing an ongoing threat to users who may inadvertently interact with the site. The domain's infrastructure, including its hosting provider and registrar, has been identified as part of a broader pattern of malicious activity. Immediate response actions include blocking the domain at the DNS or network level, reporting it to relevant security platforms for broader flagging, and monitoring for related domains using similar naming conventions or infrastructure. Despite these measures, the remaining risk remains high due to the domain's active status and the potential for credential theft. Users are advised to verify domain authenticity before entering login credentials, enable multi-factor authentication on all accounts, and report suspicious domains to their security teams or platform providers for further investigation.