challengermode-auth[.]com

On July 24 2026 analysts observed that the domain challengermode-auth.com is currently offline and returns HTTP 404. The site presents the page title “Steam Community”, indicating an attempt to impersonate the Steam platform. The domain was registered on 21 October 2025 through Global Domain Group LLC and is hosted behind Cloudflare (AS13335, United States). DNS resolution points to 172.67.131.191, with authoritative nameservers vida.ns.cloudflare.com and yoxall.ns.cloudflare.com. TLS certificates issued by Google Trust Services under the WE1 root are present, suggesting a valid HTTPS endpoint despite the 404 response.

Cloudflare Browser Insights and HTTP/3 are detected, confirming modern delivery mechanisms. Reputation data show a Scamadviser trust score of 1 / 100 and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain. VirusTotal analysis recorded 11 detections out of 95 scanned engines, and AlienVault OTX lists the domain in two separate threat pulses.

These indicators collectively confirm malicious intent, likely a generic phishing campaign targeting Steam users. Uncertainty remains regarding the exact content served before takedown, as no visual or form details are available. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same IP or nameserver pair, and update detection rules to flag the observed TLS fingerprint and HTTP 404 response combined with the “Steam Community” title. Ongoing threat‑intel feeds should be queried for additional pulses referencing challengermode-auth.com to capture potential affiliate infrastructure.