steamcommunilta[.]com

The domain steamcommunilta.com was observed hosting a gaming‑related impersonation campaign targeting Steam users. The site presented a page titled “12 Years Rust! Get your Helmet”, which aligns with the known scam type “Gaming Scam”. The domain was registered on March 11 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv6 address 2606:4700:3032::6815:59ad, an address owned by Cloudflare (AS13335) located in the United States. The SSL certificate, identified as WE1, was present but offers no indication of legitimate ownership. The site has been taken offline at the time of reporting, and its current HTTP status is unavailable.

VirusTotal scans returned 15 positive detections out of 93 security vendors, indicating that multiple anti‑malware engines classify the host as malicious. The domain is listed on a single security blocklist and appears in fifteen AlienVault OTX threat‑intel pulses, confirming community awareness of the threat. PhishDestroy has also blocked the domain, reinforcing its malicious reputation. Gridinsoft assigned a trust score of 0 / 100, reflecting an extremely low confidence in the site's safety. No additional forensic artifacts such as page source, credential‑harvesting forms, or redirect chains have been publicly released, so the exact mechanics of the credential‑stealing operation remain unknown.

Defenders should add steamcommunilta.com to blocklists at network perimeter and endpoint protection solutions. Monitoring for outbound connections to the Cloudflare IPv6 address can help detect any residual activity. Email filters should be updated to flag messages referencing “12 Years Rust” or similar phrasing that may be used in lure content. Incident response teams should treat any credential submissions to Steam‑related services as potentially compromised and enforce password resets. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related infrastructure.