gtm[.]steamproxy[.]vip

This domain, gtm.steamproxy.vip, is flagged for brand impersonation, posing a significant threat to users of the Steam platform. The site attempts to mirror the appearance and functionality of legitimate Steam login pages to trick users into providing sensitive information such as usernames, passwords, and potentially financial details.

Analysis indicates that gtm.steamproxy.vip was created on February 21, 2026, and has been flagged by 17 out of 95 security vendors on VirusTotal, a clear indicator of its malicious intent. The domain uses a RapidSSL TLS RSA CA G1 SSL certificate, which, while legitimate, does not guarantee the site's safety. Infrastructure analysis reveals that the domain resolves to the IP address 8.217.145.66, located in Hong Kong and associated with AS45102 Alibaba (US) Technology Co., Ltd. The site has also been added to two security blocklists, PhishDestroy and PhishingDB, further confirming its status as a phishing site.

If a user has visited gtm.steamproxy.vip, they should immediately change their Steam account password and enable two-factor authentication (2FA) to secure their account. Users are advised to review their account for any unauthorized activity and report the incident to Steam's customer support. Additionally, users should be cautious of any links or communications that direct them to unfamiliar login pages and verify the URL by ensuring it matches the official Steam domain.