valve-remsupport[.]ru

Analysis of valve-remsupport.ru indicates a high-risk phishing domain impersonating a post-warranty Valve service center in Moscow. The domain was registered on May 3, 2026, and currently resolves to IP 93.183.83.118, hosted by TimeWeb Ltd in Russia. Infrastructure reveals a 301 HTTP redirect, suggesting the site may forward visitors to a secondary malicious endpoint. The SSL certificate is issued by Let's Encrypt (E7), a common choice for both legitimate and fraudulent sites, offering no definitive signal of compromise. The page title, 'Постгарантийный сервисный центр Valve в Москве | Ремонт техники Valve | Техцентр Valve RemSupport,' explicitly targets Russian-speaking users by claiming affiliation with Valve, though no direct evidence confirms whether the site harvests credentials, payment details, or distributes malware. The domain appears on one security blocklist and is flagged in a single AlienVault OTX threat intelligence pulse. Four of 91 security vendors on VirusTotal detect the domain as malicious, though the specific payload or phishing kit remains unconfirmed. Defenders should treat this domain as active and hostile. The combination of recent registration, Russian hosting, and brand impersonation aligns with known phishing tactics. Network-level blocking of 93.183.83.118 and monitoring for redirect chains are recommended. Further analysis of the final destination page is required to determine exact attack vectors, but the infrastructure and known indicators justify immediate containment.