steamdt[.]co[.]at

Analysis of steamdt.co.at, observed on July 19, 2026, identifies a high‑risk brand‑impersonation campaign targeting Steam. The site presents the page title "SteamDT — Independent Resource Hub" and is secured with a Let's Encrypt R12 certificate, suggesting the use of a free TLS service. DNS resolution points to IP 209.74.82.247, an address hosted by Namecheap Inc. in Singapore. HTTP requests receive a 301 redirect, and the domain is currently active. Reputation data shows that five of ninety‑one VirusTotal scanners have flagged the host, and the domain appears on three external blocklists. It is also listed in two AlienVault OTX threat pulses and has been blocked by PhishDestroy, MetaMask, and SEAL. These indicators collectively confirm malicious intent, but the exact payload or credential‑harvesting mechanism has not been publicly disclosed. Defenders should add the domain and its IP to deny‑list rules, monitor outbound connections for attempts to resolve or contact the address, and enforce URL filtering that blocks known brand‑impersonation sites. Continuous re‑evaluation is advised, as further malicious activity may emerge if the infrastructure is expanded.