dojoker[.]duckdns[.]org

The domain dojoker.duckdns.org is confirmed to be a credential harvesting phishing site specifically targeting Steam users. Analysis indicates the site masquerades as the legitimate Steam login portal, aiming to capture user credentials through a fraudulent sign-in interface. The domain is currently offline, but prior activity aligns with high-risk phishing operations. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gandi SAS, a known registrar frequently associated with phishing campaigns. It resolved to the IP address 62.60.226.105, located in Germany under AS214351 (FEMO IT SOLUTIONS LIMITED), an autonomous system with a history of hosting malicious domains. The site employed a Let's Encrypt SSL certificate (R12) to lend an appearance of legitimacy. Detection metrics show 21 of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly labeled it as phishing. The domain appears on one security blocklist, and its page title, 'Sign In,' further corroborates its intent to mimic the Steam authentication process. Current status indicates the domain has been taken offline, likely due to remediation efforts or evasion tactics. However, the infrastructure remains a potential threat vector. Organizations and users are advised to block the domain and its associated IP (62.60.226.105) at the network level. Security teams should monitor for related domains registered through Gandi SAS or resolving to the same ASN. End-users who may have interacted with the site should immediately reset their Steam credentials and enable multi-factor authentication. Historical DNS and SSL certificate logs should be reviewed for indicators of compromise.