authdiscordconnect[.]com

On July 24, 2026, the domain authdiscordconnect.com was observed as an offline site used for a Steam brand impersonation campaign. The site presented the page title “GO VERIFY YOURSELF” and employed a Verification Scam kit, indicating an attempt to harvest credentials by prompting victims to confirm their Steam account. The domain was registered on July 10, 2025 through Web Commerce Communications Limited, and its WHOIS record shows no SSL certificate, meaning communications were unencrypted and likely delivered over plain HTTP. DNS resolution points to the IP address 178.17.62.25, which resides in Germany under autonomous system AS200823 owned by MHost LLC. The nameservers are drew.ns.cloudflare.com and val.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The IP has been blocked by PhishDestroy and appears on a single security blocklist. Scamadviser assigns a trust score of 1 out of 100, reflecting a high likelihood of malicious intent.

VirusTotal analysis recorded nine positive detections out of ninety‑five scanners, reinforcing the malicious classification. AlienVault OTX has referenced the domain in seventeen separate threat‑intel pulses, further corroborating its involvement in phishing operations. The lack of a valid TLS certificate means any victim would have encountered a non‑encrypted page, a characteristic often leveraged to bypass certificate‑pinning defenses. The single blocklist listing suggests limited exposure, yet the presence in multiple OTX pulses indicates the infrastructure has been shared among threat actors. Because the registrar is Web Commerce Communications Limited, investigators may pursue registration‑abuse reports.

The Cloudflare nameservers provide a level of anonymity, but the underlying IP remains static, simplifying sink‑hole or sink‑routing actions. No additional subdomains were observed, and the site’s offline state prevents verification of potential redirect chains.