demo[.]4svmggsbuoy6wcy4[.]non-steam[.]com

The domain demo.4svmggsbuoy6wcy4.non-steam.com was registered on August 23, 2019 through Danesco Trading Ltd. and remains active as of the report date, July 21, 2026. DNS resolution points to the IPv4 address 81.91.178.184, and the domain is served by Cloudflare nameservers ian.ns.cloudflare.com and rita.ns.cloudflare.com. VirusTotal analysis shows that eight of ninety‑one security vendors have flagged the domain, indicating a measurable level of malicious detection across independent scanners. The domain is currently listed on one security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing its classification as a high‑risk phishing vector. No public page title or content analysis is available, so the exact landing page characteristics remain unknown, limiting insight into the specific credential‑capture mechanisms employed. Infrastructure evidence suggests the operator leverages reputable DNS services to obscure hosting details, a common tactic for phishing infrastructure. Defenders should prioritize immediate DNS‑level blocking of the domain and the associated IP address, incorporate the domain into threat‑intel feeds, and monitor outbound connections for any attempts to reach the resolved host. Continuous re‑scanning with multi‑vendor engines is advised to capture any evolution in payload or hosting changes. Network sensors should alert on HTTP or HTTPS requests to the domain, and endpoint protection should enforce policies that block credential submission to untrusted origins. Given the confirmed detection count and blocklist presence, proactive containment is recommended to mitigate credential theft risk.