wickbot[.]virtualswaifus[.]art

This domain, wickbot.virtualswaifus.art, is flagged as a credential harvesting site targeting Steam users. Analysis indicates the page mimics Steam's login interface to capture account credentials, likely deploying a JavaScript-based form grabber or session hijacking script. No explicit drainer kit signature has been confirmed, but the page title 'Nur einen Moment…' suggests a redirect or loading screen used to mask malicious activity during the phishing sequence.

Infrastructure analysis reveals the domain was registered on September 16, 2025, through NameCheap, Inc. It resolves to the IPv6 address 2a06:98c1:3121::3, a Cloudflare proxy endpoint commonly used to obfuscate hosting origins. VirusTotal reports 6/95 security vendors detecting the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on a single security blocklist, and Google Safe Browsing (GSB) has not yet indexed it as a threat, though this may reflect a lag in propagation rather than benign status.

The domain is currently offline, likely taken down following abuse reports or registrar intervention. No active connections or live phishing pages were observed at the time of analysis. However, residual risk remains due to the domain's recent creation and the potential for re-registration or migration to a new hosting provider. Organizations are advised to block the domain and associated IP at the perimeter, monitor for credential reuse tied to Steam accounts, and review logs for prior connections to 2a06:98c1:3121::3. Users should be alerted to reset credentials if they interacted with the domain before takedown.