23d0-4442-afd6-d5ab1147ce38[.]non-steam[.]com

Analysis of the domain 23d0-4442-afd6-d5ab1147ce38.non-steam.com indicates active phishing infrastructure targeting Steam users, as suggested by the subdomain structure. The domain was registered on August 23, 2019, through Danesco Trading Ltd. and remains operational as of July 21, 2026. It resolves to the IP address 81.91.178.184 and uses Cloudflare nameservers (ian.ns.cloudflare.com and rita.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. Detection data shows the domain is flagged by 8 of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The domain's structure, including the 'non-steam.com' suffix, strongly suggests an intent to impersonate Steam or exploit its branding, though the exact content of the phishing page has not been analyzed. Defenders should treat this domain as high-risk, particularly for credential harvesting or account takeover attempts. The use of Cloudflare nameservers and a long-standing registration date may indicate an effort to maintain persistence. Organizations are advised to block the domain at the DNS level and monitor for connections to the associated IP address 81.91.178.184. Further investigation into the hosting provider and registrar may aid in mitigation efforts.