zaebaseter[.]glebplay[.]pro

Analysis of zaebaseter.glebplay.pro indicates this domain was a brand impersonation threat targeting Steam users, operational until recently taken offline. Registered on November 13, 2025, through Dynadot LLC, the domain resolved to 188.114.97.3, an IP address hosted on Cloudflare's network (AS13335). The page title 'Sign In' aligns with typical credential harvesting tactics, though the exact content and functionality remain unconfirmed due to its current offline status. Fifteen of 95 security vendors on VirusTotal flagged this domain, and it appears on at least one security blocklist, including PhishDestroy.

No SSL certificate was detected, which is atypical for legitimate login portals and further supports the assessment of malicious intent. Defenders should treat this domain as high-risk for Steam credential theft, particularly given its explicit brand target. The infrastructure leverages Cloudflare, a common tactic to obscure hosting origins and evade IP-based blocking.

While the domain is now offline, historical DNS and WHOIS records should be preserved for forensic analysis. Organizations are advised to block this domain across web gateways, email filters, and endpoint protection systems, and monitor for any re-registration or related domains under the glebplay.pro namespace. No evidence links this domain to a specific phishing kit or campaign beyond the Steam impersonation noted in available intelligence.