mobile[.]authg[.]top

Analysis of the domain mobile.authg.top indicates it was actively involved in a gaming scam targeting Steam users, as documented in threat intelligence records. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 172.67.156.243, hosted on Cloudflare's infrastructure (AS13335). No SSL certificate was present, increasing the risk of unencrypted credential interception. The page title 'Sign In' aligns with common phishing tactics used to deceive users into submitting login credentials.

Infrastructure analysis reveals the domain was taken offline by July 23, 2026, though it remains flagged by security vendors. Sixteen of the 93 security vendors on VirusTotal detected the domain as malicious, and it appears on at least one security blocklist, including PhishDestroy. The absence of an SSL certificate and the use of Cloudflare nameservers (christian.ns.cloudflare.com and sima.ns.cloudflare.com) are consistent with phishing campaigns leveraging content delivery networks to obscure hosting origins. While the domain is no longer active, defenders should treat any residual DNS or proxy connections to 172.67.156.243 as suspicious.

Organizations targeting Steam users or gaming-related threats may prioritize blocking this domain and its associated IP in perimeter defenses. Further investigation into the registrar's response and potential sinkholing of the domain could provide additional context on the campaign's scope. The exact phishing kit or payload used remains unconfirmed, as no forensic artifacts from the live site were available for analysis.