backend[.]notexistsnews[.]non-steam[.]com

backend.notexistsnews.non-steam.com was registered on August 23, 2019 through Danesco Trading Ltd. The domain resolves to the IPv4 address 81.91.178.184 and is served by Cloudflare nameservers ian.ns.cloudflare.com and rita.ns.cloudflare.com. VirusTotal scans have identified the domain as malicious in eight of ninety‑five antivirus or URL‑reputation engines, indicating a moderate level of detection across the community. The domain appears on a single public blocklist and is specifically listed by the PhishDestroy service, confirming that at least one anti‑phishing provider has taken active mitigation steps. The current operational status is reported as active, meaning the domain continues to resolve and can be contacted by clients. Evidence points to a generic phishing campaign, although the exact target brand or credential‑stealing template has not been disclosed in the available data. The lack of additional public intelligence such as Safe Browsing entries, OTX tags, or SSL certificate details leaves the full scope of the campaign uncertain. Defenders should treat any traffic to or from 81.91.178.184 as potentially hazardous, enforce outbound URL filtering to block the domain, and consider adding the domain to internal blocklists. Network monitoring should include DNS query logs for the domain and any sub‑domains, and intrusion‑detection signatures that reference the observed IP address or the Cloudflare name server pair may provide early warning. Because the registrar is a known corporate entity, domain‑takeover attempts are unlikely, but the continued activity suggests the infrastructure is still under attacker control. Ongoing vigilance is advised, and periodic re‑scans with VirusTotal or similar services are recommended to capture any changes in detection scores.