glebplay[.]pro

On July 23, 2026, analysis of the domain glebplay.pro confirms a high‑risk brand‑impersonation campaign targeting the Steam platform. The site’s HTTP response presented the page title "glebplay.pro Platfrom", which aligns with the observed scam type of brand impersonation. The domain is hosted behind Cloudflare’s network; DNS resolution returns the IP address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated to the United States. Both authoritative nameservers are Cloudflare‑provided (raina.ns.cloudflare.com, seamus.ns.cloudflare.com), and the registration was performed through Cloudflare, Inc., indicating the use of the provider’s domain‑privacy services. No TLS certificate was observed, meaning the site was served over plain HTTP, which is consistent with many quick‑deployment phishing infrastructures.

Threat‑intelligence aggregators have flagged the domain. VirusTotal recorded detections from 15 of 95 scanned security vendors, demonstrating a moderate consensus of malicious behavior. Google Safe Browsing categorizes the URL as a social‑engineering threat, while the PhishDestroy blocklist lists the domain as malicious, providing a single external blocklist reference. AlienVault Open Threat Exchange includes the domain in 16 distinct pulses, further corroborating its association with malicious activity. The site’s current status is offline, suggesting that the operators have withdrawn the landing page, possibly to evade further analysis.

While the available data clearly indicates a Steam‑related impersonation attempt, the exact content of the landing page has not been captured, leaving the specific credential‑harvesting mechanisms unknown. Defenders should proactively block DNS resolution for glebplay.pro, add the IP address 188.114.96.3 to network‑level deny lists, and monitor for any related Cloudflare‑originated subdomains that may reuse the same infrastructure.