dlscorddota[.]pro

This domain, dlscorddota.pro, is actively hosting a fake Steam verification phishing scheme designed to harvest user credentials under the guise of account validation. The site mimics legitimate Steam login and verification processes, targeting gamers who may be prompted to enter sensitive information to purportedly secure or unlock their accounts. Analysis confirms the domain is currently operational and serving malicious content, with no legitimate affiliation to Steam or its parent organization. Infrastructure analysis reveals the domain was registered on May 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 5.253.61.77, which has been flagged by 19 of 95 security vendors on VirusTotal for malicious activity. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and Hagezi. Detected technologies include Nginx as the web server, alongside jQuery UI and jQuery, which are commonly exploited to facilitate dynamic content delivery and credential capture. The page title, GO VERIFY YOURSELF, further corroborates the phishing intent, as it mirrors language used in social engineering attacks to create urgency. The domain remains active and poses a significant risk to users who may be deceived into entering login credentials or other sensitive data. Immediate mitigation steps are recommended, including blocking the domain and its associated IP at the network level, as well as implementing browser-based protections to prevent user access. Organizations should update security awareness training to highlight the tactics used in this campaign, particularly the impersonation of Steam verification processes. Monitoring for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to the same IP range may help identify related threats. Users who have interacted with this domain should be advised to reset their credentials and enable multi-factor authentication on all accounts.