steam-db[.]com

PhishDestroy identifies steam-db.com as a live credential-harvesting site posing as the legitimate Steam Database at SteamDB.info, actively luring Steam users into surrendering login credentials. The domain employs visual spoofing of the targeted site’s interface and branding to deceive visitors, while background scripts exfiltrate entered credentials to attacker-controlled servers. Given the high-risk nature of account-takeover operations and the observed persistence of the domain, immediate defensive action is warranted. This domain was flagged by 13 out of 95 VirusTotal security vendors, indicating moderate but concerning detection coverage, and resolves to the IP address 104.21.20.129, which has a history of hosting phishing infrastructure. The domain steam-db.com was registered on November 8, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently implicated in bulk domain purchases with loose identity verification. Despite its recent creation, the domain already appears on multiple threat intelligence feeds, with no known takedown activity as of this analysis. The SSL certificate is issued by Google Trust Services and appears legitimate at first glance, though it is being abused to lend an air of authenticity to the phishing page. To mitigate exposure to this threat, organizations should immediately block both the domain steam-db.com and the associated IP address 104.21.20.129 at the network perimeter and DNS level. Security teams are advised to push outbound firewall rules to prevent data exfiltration to this IP. Users should be warned via internal advisories to verify domain spelling and use bookmarks or official sources for Steam-related services. Security operations should hunt for internal DNS queries to steam-db.com or outbound connections to 104.21.20.129 as indicators of compromise.