help[.]steamipconfirm[.]com

Analysis of help.steamipconfirm.com shows a recently registered infrastructure designed to impersonate the Steam brand. The domain was created on February 25, 2026 and registered through Hello Internet Corp. It is delegated to Cloudflare nameservers (tara.ns.cloudflare.com and todd.ns.cloudflare.com) and resolves to the IP address 172.67.145.10, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No SSL certificate is presented for the host, indicating that HTTPS connections are not secured.

The only visible page title returned during the brief capture was "Support :: cegonha," which does not reference Steam and suggests the landing page content has not been publicly disclosed. VirusTotal scanning recorded a single positive detection out of 93 security vendors, and the domain appears on one external blocklist. PhishDestroy has also listed the domain as blocked, confirming that defensive feeds consider it malicious.

The site is currently offline, limiting immediate observation, but the combination of brand targeting, recent registration, Cloudflare hosting, and a vendor detection collectively point to a gaming‑related scam infrastructure. Defenders should continue to monitor the associated IP address for any reactivation, enforce outbound filtering for URLs containing "steamipconfirm," and ensure that user‑facing security products reference the current blocklist entries. Further investigation is needed to capture the actual payload or credential‑collection page, as the present evidence does not reveal the exact phishing mechanism employed.