steamcomunity[.]aiq[.]ru

This domain, steamcomunity.aiq.ru, is a high-risk brand impersonation threat designed to deceive users of the Steam platform. Analysis indicates the domain mimics legitimate Steam community pages, likely to harvest login credentials, payment details, or distribute malicious software. The fraudulent infrastructure leverages social engineering tactics, such as replicating Steam’s visual design and URL structure, to trick users into believing they are interacting with an official service. Given the domain’s focus on Steam, a widely used gaming platform, the potential impact includes unauthorized account access, financial fraud, and malware infections targeting both individual users and organizations with shared credentials. Infrastructure analysis reveals multiple indicators of malicious activity. The domain resolves to the IP address 212.46.196.133, hosted on AS3216 (PJSC Vimpelcom) in Russia, a network previously associated with phishing campaigns. At the time of assessment, 20 out of 95 security vendors on VirusTotal flagged the domain as malicious, while two additional security blocklists have listed it for phishing-related activity. The domain lacks an SSL certificate, further reducing its legitimacy and increasing the risk of man-in-the-middle attacks. Registration details indicate the domain was likely created through a registrar that does not enforce stringent identity verification, a common tactic among threat actors to evade detection and takedown efforts. Users who have visited steamcomunity.aiq.ru should take immediate remediation steps to mitigate potential compromise. First, any credentials entered on the site must be considered exposed and should be changed immediately across all platforms where the same password was reused. Enable multi-factor authentication on the Steam account and monitor for unauthorized transactions or activity. If payment details were submitted, contact financial institutions to flag potential fraudulent charges. Additionally, scan the device used to access the domain for malware, as phishing pages often redirect to exploit kits or serve malicious downloads. Report the domain to relevant security teams or abuse contacts to aid in broader takedown efforts and prevent further victimization.