auth[.]mobilvers[.]top

This domain, auth.mobilvers.top, is a credential harvesting site designed to impersonate Steam’s authentication portal. The page displays the title 'Anmelden' (German for 'Log In'), targeting users expecting Steam’s legitimate login interface. Visitors entering credentials risk account compromise, unauthorized access to gaming libraries, payment details, and linked services. The site’s infrastructure mimics Steam’s branding to deceive users into submitting sensitive information, which threat actors then exploit for fraud, unauthorized purchases, or further phishing campaigns. Analysis indicates the domain was registered on February 21, 2026, an unusually future date suggesting potential typosquatting or preemptive registration for malicious use. It resolves to IP address 188.114.97.3, hosted under AS13335 (Cloudflare, Inc.), a provider frequently abused for phishing due to its anonymization capabilities. The SSL certificate (WE1) is non-standard, further deviating from Steam’s legitimate infrastructure. As of detection, 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on two blocklists: PhishDestroy and PhishingDB. The domain’s current status is offline, but similar campaigns often resurface under new domains. If you visited auth.mobilvers.top and entered credentials, immediate action is required. First, reset your Steam password using a trusted device and enable multi-factor authentication (MFA) via Steam Guard. Review recent account activity for unauthorized logins or transactions, and revoke access to unfamiliar devices or applications. Check linked payment methods for fraudulent charges and update passwords for any accounts sharing the same credentials. Monitor for phishing emails or messages impersonating Steam support, as threat actors may attempt follow-up attacks. Report the incident to Steam’s support team and consider notifying relevant financial institutions if payment details were exposed.