api[.]argo[.]non-steam[.]com

Analysis of the domain api.argo.non-steam.com shows that it was registered on August 23 2019 through Danesco Trading Ltd. The authoritative name servers are ian.ns.cloudflare.com and rita.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s proxy service. DNS resolution returns the IPv4 address 81.91.178.184. VirusTotal has recorded eight positive detections out of ninety‑five scanned scanners, confirming that multiple security vendors have identified malicious behavior associated with the domain. The domain is currently listed as active and appears on at least one public security blocklist; it has also been explicitly blocked by the PhishDestroy mitigation platform. No publicly available SSL certificate details, HTTP response codes, or page title information have been reported, so the exact web content and transport security posture remain unknown. Likewise, the presence or absence of Safe Browsing, OTX, or additional blocklist entries cannot be confirmed from the supplied data. The available evidence points to a credential‑harvesting operation, consistent with the generic phishing classification provided. The combination of Cloudflare front‑ending, a persistent IP address, and multiple vendor detections suggests a deliberately maintained infrastructure designed to evade takedown. Defenders should prioritize immediate containment of traffic to api.argo.non-steam.com and to its resolved IP 81.91.178.184. Adding the domain and IP to DNS‑based blocklists, firewall deny lists, and endpoint URL filtering rules will reduce exposure. Continuous monitoring of the IP for any changes in hosting or additional malicious activity is recommended. Organizations employing phishing‑resistant authentication should treat any credential requests originating from this domain as fraudulent. Incident response teams should collect any logs that reference the domain for further forensic correlation.