mob[.]entered[.]top

This domain, mob.entered.top, is flagged for brand_impersonation targeting Steam, a digital distribution platform. Analysis indicates the infrastructure was designed to mimic the Steam login interface, as evidenced by the page title 'Connexion,' which suggests a credential harvesting attempt. No specific drainer kit signatures were identified in available telemetry, though the operational pattern aligns with common phishing toolkits used for account compromise. Infrastructure analysis reveals the domain was registered on February 21, 2026, and resolves to IP address 172.67.208.59, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is associated with a WE1 SSL certificate and has been flagged by 17 out of 95 security vendors on VirusTotal. It appears on two security blocklists, including PhishDestroy and PhishingDB, though it is not currently listed on Google Safe Browsing. The creation date and rapid detection by multiple engines suggest a short-lived, high-velocity phishing campaign. As of the latest assessment, mob.entered.top has been taken offline, likely due to hosting provider intervention or registrar suspension. While the immediate threat is mitigated, the infrastructure may reappear under a new domain or IP. Users who interacted with the site should assume credential exposure and initiate password resets, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated indicators to prevent future access attempts.