mobile[.]authw[.]top

mobile.authw.top was registered on 2026-02-21 through Web Commerce Communications Limited and uses Cloudflare’s DNS (christian.ns.cloudflare.com, sima.ns.cloudflare.com). The domain resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP. The only visible page element recorded is the title “Anmelden”, which is German for “login”, indicating a possible credential‑capture page targeting Steam users.

Gridinsoft assigns a trust score of 0 / 100, and twelve of ninety‑three VirusTotal scanners flag the host as malicious. The domain appears on a single external blocklist and has been taken down by PhishDestroy. The elevated risk rating reflects the combination of a zero trust score, lack of TLS, and the presence of a German‑language login cue that aligns with known Steam credential‑theft patterns. Absence of a valid SSL certificate makes man‑in‑the‑middle interception trivial, and the use of Cloudflare’s shared IP space can obscure the true origin of the operator.

Although the current status is offline, the infrastructure – a Cloudflare‑fronted IP without encryption – could be re‑used for future impersonation campaigns. Defenders should add mobile.authw.top to DNS‑based deny lists, block outbound connections to 188.114.97.3, and enforce strict HTTPS validation for any Steam‑related traffic. Security teams should also monitor the registrar Web Commerce Communications Limited for new registrations that reuse the same nameservers, and apply user‑education controls warning that legitimate Steam logins never use a “mobile.authw.top” URL and always employ HTTPS with a valid certificate. Continuous DNS monitoring for any re‑registration of mobile.authw.top or similar subdomains should be instituted, and any traffic matching the pattern should be logged for forensic analysis.