zaeb[.]tryhardcup[.]pro

Analysis of the domain zaeb.tryhardcup.pro indicates a brand-impersonation phishing campaign targeting Steam users, operational as of July 23, 2026. The domain was registered through RU-LLCDDOS-GUARD-20161123 (ASN 57724), a registrar associated with infrastructure frequently utilized for malicious activities. Infrastructure analysis reveals the domain resolves to the IP address 185.178.208.189, geolocated in Russia and hosted under AS57724 (DDOS-GUARD LTD), a network previously linked to phishing and distributed denial-of-service mitigation services. No SSL certificate was detected, increasing the likelihood of unencrypted credential harvesting. The page title 'Anmelden' (German for 'Log in') suggests the phishing kit is designed to target German-speaking users, aligning with the impersonation of Steam, a platform with a significant user base in the region.

Detection metrics indicate moderate awareness among security vendors. As of the report date, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist, specifically PhishDestroy, which classified it as a phishing threat prior to its takedown. Gridinsoft assigned a trust score of 0/100, further corroborating its suspicious nature. No nameserver records were identified at the time of analysis, which may indicate an attempt to evade detection or a misconfiguration in the domain's setup.

The domain is currently offline, though historical data confirms its prior use in a phishing operation. Defenders are advised to monitor for re-registration or re-emergence under similar infrastructure, particularly within AS57724 or associated IP ranges. Network-level blocking of 185.178.208.189 and domains registered through RU-LLCDDOS-GUARD-20161123 may mitigate residual risk. Endpoint protection solutions should update signatures to include this domain and its associated indicators.