"Vote for my Workshop Item" Phishing scam Misspellings of steamcommunity.com,

(this is likey a stolen account used for this: https://rep.tf/76561199380940581)

Original link: https://steam.communityfileshareds.com/sharedfiles/tropic_White_Chip

Got the original site taken down within 12h of me getting first messaged, the scammer messaged me back to say “you didnt influence anything with your rat act” among a bit of filler to show that he was definetly not mad about that. URL scan of https://urlscan.io/ip/188.114.96.3 showed ~19 sites that where scanned within the last 4h of that point that I could easily identify. Most of these either give 404 errors or Cloudflare errors, but some have some different stuff running.

https://steamcomunmnity.com/

https://steamcommuntly.ru/

https://steamporewed.com/

https://steamcoommunuty.ru/

https://steamcommunityworkpowered.com/

https://steamcomunmnity.com/

https://steamcomunjty.com/

https://steamcormunityy.ru/

https://steamcommuniny.com/

https://stemcommumty.com/

https://counterstrikes.net/

https://source2.es/

https://steamcommurliy.ru/

https://steamcomrnuniyy.ru/

https://sleamcommunyti.xyz/

https://stearncommunutly.ru/

https://steamcomurnilty.ru/

https://cs2-twitch-drops.com/

https://faceit-verifi.com/

Note that a few of these seam to be running Lampa, as the description of these sites says in russian “Lampa - Catalog of films and series An application for viewing a catalog of movies and series on TVs, set-top boxes and smartphones.”

Im not sure if all of these already have “clientTransferProhibited” status and still havnt gotten to contacting the registrar.

successfully taken down the domain hxxps://steamcommunityworkpowered[.]com/
image