worldwide5e[.]com

This domain, worldwide5e.com, was created on August 11, 2024 via the REGRU-RU registrar and is currently listed as taken offline. The authoritative name servers are katja.ns.cloudflare.com and lynn.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. DNS resolution points to the IP address 172.67.223.224, which is owned by AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented for the host, indicating that HTTPS connections would be unencrypted or rejected.

The site’s HTTP response includes the page title “Anmelden”, a German term for “login”, and the domain has been classified as a brand‑impersonation campaign targeting the Steam service. The infrastructure is flagged by at least one security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal reports a single positive detection out of ninety‑five scanning engines, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain appears on one additional blocklist, further confirming its reputation as abusive.

Evidence suggests the operator leveraged Cloudflare’s free hosting to obscure the true origin of the malicious page while presenting a login‑style title to lure victims. Because the domain is presently offline, active exploitation cannot be confirmed, but the historical indicators—registrar choice, lack of encryption, brand‑targeted naming, and multiple security vendor detections—point to a deliberate phishing infrastructure. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or similar naming patterns, and correlate any outbound traffic to the IP 172.67.223.224 with known threat‑intel feeds. Ongoing observation of the REGRU‑RU registrar may also reveal additional campaigns using related domains.