authg[.]authmobilever[.]xyz

On 24 July 2026 analysts observed that the domain authg.authmobilever.xyz was taken offline after being identified as a high‑risk brand‑impersonation campaign targeting Steam users. The site presented a page titled “Sign In”, a typical indicator of credential‑harvesting attempts. Registration data show the domain was created on 17 November 2025 through Web Commerce Communications Limited and is hosted on Cloudflare’s network (ASN 13335). DNS resolution points to IP 172.67.197.79, which is listed as a Cloudflare‑owned address located in the United States.

No TLS certificate was observed, meaning the site served HTTP only, which reduces the credibility of the service but does not preclude malicious intent. The domain was added to the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal scans recorded eleven detections out of ninety‑five participating vendors, and Google Safe Browsing classified the URL as social engineering. The combination of a recent registration, Cloudflare hosting, lack of encryption, and multiple security vendor alerts supports the conclusion that the domain was used to lure Steam account credentials.

Because the site is currently offline, active exploitation cannot be confirmed, but the infrastructure—particularly the IP address and Cloudflare nameservers—may be reused for future campaigns. Defenders should pre‑emptively block the domain and its resolving IP, monitor for re‑registration or similar sub‑domains, and enforce strict URL filtering for “Sign In” pages that reference Steam. Continuous intelligence gathering on the associated IP range and Cloudflare‑hosted assets is recommended to detect potential re‑deployment.