store[.]steamchina[.]com

Analysis of store.steamchina.com shows a domain created on 10 Nov 2012 that is currently active and flagged for brand impersonation of Valve. The site presents the Chinese page title “登录”, indicating a login‑oriented page, but no further content has been publicly verified. Infrastructure details reveal the domain is hosted on Alibaba Cloud Computing (Beijing) with authoritative nameservers vip3.alidns.com and vip4.alidns.com. The web server runs Nginx, serves jQuery, and enforces HSTS, while the SSL certificate is a DigiCert GeoTrust EV G2 TLS RSA‑4096 SHA256 issued in 2022, suggesting a legitimate‑looking TLS layer. The domain resolves to IP 43.159.95.47, located in Singapore and announced by AS139341 (ACE). A Gridinsoft trust score of 4/100 places the site in the lowest confidence tier, and PhishDestroy has already added it to its blocklist. No public malware detections are recorded, but absence of detections does not confirm safety. Given the brand‑impersonation classification, the presence of a login‑related title, low trust rating, and active blocklist status, defenders should treat the domain as malicious. Recommended actions include adding the domain and its IP to network blocklists, monitoring DNS queries for the domain, and alerting end‑users that any credential entry on this site is likely fraudulent. Further investigation should focus on traffic patterns, any credential harvesting mechanisms, and potential ties to broader Valve‑related phishing campaigns.