auth-connectdiscord[.]com

The domain auth-connectdiscord.com was registered on July 08, 2025 through Web Commerce Communications Limited and is currently taken offline. DNS resolution points to the Cloudflare‑owned address 172.67.213.50, hosted in the United States under ASN 13335. The domain is served without an SSL certificate, and its authoritative nameservers are drew.ns.cloudflare.com and val.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS infrastructure. The site’s only observed page title is “GO VERIFY YOURSELF,” and the threat actor is classified as employing a Verification Scam kit that explicitly impersonates the Steam brand.

The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy service. It has been observed in 17 AlienVault OTX threat‑intelligence pulses, suggesting that multiple analysts have flagged its activity. VirusTotal analysis shows 14 of 95 scanners flagging the domain, reinforcing its malicious reputation. Although the site is presently offline, the combination of a brand‑targeted verification lure, a recent registration date, lack of TLS, and association with known blocklists and OTX pulses provides a clear indicator of malicious intent.

Defenders should continue to monitor the resolved IP for any resurgence, enforce blocklist updates that include auth‑connectdiscord.com, and apply URL filtering rules that deny requests to this host. Additionally, security teams should educate users about unsolicited “verify yourself” prompts that claim to originate from Steam, emphasizing that legitimate Steam communications never request credential verification via external links. Organizations employing web‑proxy or DNS‑filtering solutions should ensure the domain is denied, and incident response teams should treat any related traffic as potentially compromised.