ticket[.]valveauth[.]com

PhishDestroy analysts have confirmed that ticket.valveauth.com is an active counterfeit gaming ticket scam hosted on a deceptive ValveAuth-branded domain. The site is engineered to harvest Steam credentials and payment details under the guise of selling in-game event tickets, making it a high-risk threat to the gaming community.

This domain was flagged after rigorous technical analysis and is currently under investigation. Intelligence reveals the domain was registered through Global Domain Group LLC on April 17, 2026, and resolves to IP 104.21.90.13, which hosts multiple recently activated phishing campaigns. Notably, the SSL certificate issued by Let’s Encrypt provides a false sense of legitimacy, while current VirusTotal scans show 0 detections out of 95 security engines, indicating low initial detection rates typical of emerging threats. The domain’s recent creation and clean reputation score further suggest it was deployed with malicious intent to evade early blocklists.

To mitigate exposure to this counterfeit ticket scam, gamers should avoid clicking on any links from untrusted sources or ads promoting Valve events. Always verify official ticket sources via the Valve Steam client or authorized partners. Network administrators are advised to block the IP address 104.21.90.13 and monitor for outbound connections to the domain. Users who may have entered credentials should immediately change their Steam password and enable two-factor authentication. Report suspicious domains to PhishDestroy or your regional cybersecurity authority to help disrupt the threat actor’s infrastructure.