authg[.]authmobilver[.]xyz

The domain authg.authmobilver.xyz was observed resolving to the Cloudflare address 104.21.70.179, hosted within AS13335 (Cloudflare, Inc.) in the United States. Registration data shows the domain was created on 19 November 2025 through the registrar Web Commerce Communications Limited. The authoritative nameservers are hunts.ns.cloudflare.com and zelda.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. No TLS certificate is presented, indicating the site operates without HTTPS encryption. Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has added the domain to its blocklist.

Independent scanning on VirusTotal returned 11 positive detections out of 95 security vendors, confirming malicious intent. The domain appears on a single external blocklist, reinforcing its reputation as malicious. The page title returned from the HTTP response is “Sign In”, and the domain is explicitly marked as impersonating the Steam brand. Current monitoring indicates the site has been taken offline, but the infrastructure components—including the Cloudflare IP and registrar—remain active and could be reused for future campaigns. Analysts should continue to block the domain at network perimeter and DNS layers, and update detection signatures to include the observed nameserver pattern and the specific IP address.

Because the site lacks SSL, any future re‑activation would be immediately flagged by TLS inspection tools. The exact page content beyond the title is not available because the site is offline, so payload analysis cannot be performed. Further investigation should focus on any related subdomains that resolve to the same Cloudflare IP block and on traffic patterns targeting Steam‑related credentials. Defenders are advised to monitor for similar Cloudflare‑hosted domains with the same nameserver pattern and consider adding the IP address to reputation lists.