hkttxpayments[.]non-steam[.]com

This domain, hkttxpayments.non-steam.com, operates as a credential theft scam targeting Steam users. Analysis indicates the site mimics legitimate Steam payment pages, tricking visitors into entering their account credentials. Once submitted, these details are harvested by threat actors for unauthorized access, account takeovers, or resale on underground markets. The scheme may also deploy malware or redirect users to additional fraudulent pages to maximize data extraction. Infrastructure analysis reveals multiple red flags confirming malicious intent. The domain was registered on June 08, 2026, through Danesco Trading Ltd., a registrar often associated with suspicious activity. It resolves to the IP address 81.91.178.184 and uses a Let's Encrypt SSL certificate, which is commonly exploited by threat actors to appear legitimate. Security vendors flagged the domain in 17 out of 95 scans on VirusTotal, and it appears on at least one security blocklist. The domain has since been taken offline, but similar threats may persist under different names. If you visited hkttxpayments.non-steam.com or entered any credentials, immediate action is required. First, change your Steam password and enable two-factor authentication (2FA) if not already active. Review your account for unauthorized transactions, linked payment methods, or unfamiliar devices. Scan your device for malware using updated security software, as credential theft sites often deploy additional payloads. Monitor your email and other accounts for suspicious activity, as compromised credentials may be used across multiple platforms. Report the incident to Steam support and consider notifying relevant authorities if financial data was exposed.