streambotauth[.]xyz

This domain, streambotauth.xyz, is identified as a credential theft operation targeting users of the Twitch streaming platform. Analysis of the page title, "STREAMTOOLS - Twitch OAuth," indicates an attempt to impersonate legitimate Twitch authentication workflows, likely to harvest user credentials under false pretenses. No direct evidence of a crypto drainer kit was observed, but the focus on OAuth suggests an intent to gain unauthorized access to accounts for further exploitation, such as spreading malware or conducting fraudulent transactions. The use of Twitch branding aligns with common phishing tactics designed to exploit trust in well-known platforms.

Technical indicators reveal multiple red flags associated with streambotauth.xyz. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive registrations. It resolves to the IP address 172.67.198.206, which is part of a network known for hosting malicious content. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently classified as offline. Infrastructure analysis further reveals the use of Cloudflare and HTTP/3, which may be employed to obfuscate the origin of the attack and evade detection.

As of the latest assessment, streambotauth.xyz has been taken offline, likely in response to detection by security systems such as PhishDestroy. However, the elevated risk level persists due to the domain's recent registration, association with credential theft, and prior malicious activity. Users who may have interacted with the domain are advised to immediately revoke any granted permissions, reset their Twitch credentials, and monitor their accounts for unauthorized activity. Organizations should update their blocklists to include this domain and its associated IP address to prevent future access attempts. Given the transient nature of such threats, vigilance is recommended, as the actors behind this campaign may deploy similar infrastructure under different domains.