steamcomunity-client[.]netlify[.]app

This domain, steamcomunity-client.netlify.app, operates as a credential harvesting phishing site targeting Steam users. Analysis indicates the site presents a fraudulent login portal titled 'Iniciar sessão' (Portuguese for 'Sign in'), designed to mimic the legitimate Steam Community platform. The domain specifically aims to deceive users into submitting their account credentials, which are then captured and likely exfiltrated to attacker-controlled infrastructure. The use of a Portuguese-language login page suggests targeting of users in Portuguese-speaking regions, though the threat is not geographically restricted. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 19 out of 95 security vendors on VirusTotal, including detection labels such as 'phishing' and 'malicious site.' It resolves to the IP address 63.176.8.218 and is hosted through Netlify, a legitimate platform often abused for phishing due to its free hosting services. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides HTTPS encryption but does not validate the site's legitimacy. Notably, the domain's creation date is listed as June 15, 2026, an anomaly suggesting either a typo in registration data or an attempt to evade detection by appearing future-dated. The domain appears on at least one security blocklist and remains active as of this report. Users who have visited steamcomunity-client.netlify.app or entered credentials on the site should take immediate action. First, change Steam account passwords using a known-legitimate device and enable multi-factor authentication if not already active. Monitor the account for unauthorized activity, including purchases, friend requests, or changes to security settings. If payment methods are linked to the account, review transaction histories for fraudulent charges. Clear browser cache and cookies to remove any persistent session tokens. Avoid clicking on links in unsolicited messages, even if they appear to originate from Steam or gaming-related contacts. Report the incident to Steam support and consider notifying local cybersecurity authorities if financial data was exposed. Infrastructure owners should block the domain and IP 63.176.8.218 at the network perimeter to prevent further access.