steam[.]mechanicshot[.]de

PhishDestroy identifies steam.mechanicshot.de as a live credential-phishing domain masquerading as the official Steam support portal. This domain was flagged by PhishDestroy under seed 2ca33d with a risk level still under investigation but confirmed active. All intelligence points to a recently activated trap. VirusTotal shows zero detections (0/95 engines) and the site resolves to IP 162.55.217.149. The domain uses a Let's Encrypt SSL certificate and was observed serving a spoofed Steam login page designed to harvest usernames and passwords. The registrar is Cloudflare, Inc., and the domain resolves to a German IP range commonly associated with transient hosting. The absence of detections on VirusTotal does not guarantee safety; such zero-detection phishing pages often fly under the radar for 24–72 hours, luring victims during this blind spot. Steam account takeovers from this campaign can lead to financial loss, unauthorized game purchases, and exposure of payment data linked to the compromised account. The domain has not yet appeared on any public blocklists, and its trust score remains unestablished due to its youth. To mitigate credential theft, users should avoid clicking links in unsolicited emails or messages referencing Steam. Always navigate directly to store.steampowered.com via a trusted browser bookmark. Enable Steam Guard two-factor authentication to add a critical second layer of defense. If credentials are entered, immediately change the password, revoke unknown sessions, and monitor linked payment methods. Report the domain to Steam support and consider revoking any third-party app permissions under the compromised account.