Is prod.admin.steamlevelu.com safe?

No. MalwareAnalyzer scanned prod.admin.steamlevelu.com on 21 Aug 2026 and returned a malicious verdict with a score of 73 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

How was prod.admin.steamlevelu.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

prod.admin.steamlevelu.com - malicious URL scan, 21 Aug 2026

MalwareAnalyzer by Cyble scanned prod.admin.steamlevelu.com and returned a malicious verdict (score 73), categorised as phishing. The page resolved to 95.129.238.32 on DDOS-GUARD LTD in RU. The domain was registered 2175 days ago through Registrar of Domain Names REG.RU LLC. 5 domains and 1 IP were contacted, over 32 HTTP requests. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.

Scan result

Verdict: malicious (score 73) · Confidence 82%
Scanned URL: https://prod.admin.steamlevelu.com/
Domain: prod.admin.steamlevelu.com · IP: 95.129.238.32 · RU
Server: ddos-guard
Page title: SteamLevelU - Fast and Сheap way to level up! With us you can level up your Steam profile
HTTP status: 200 · text/html;charset=utf-8
Registrar: Registrar of Domain Names REG.RU LLC · domain age 2175 days · created 2020-09-05
TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Nov 17 22: · subject CN=prod.admin.steamlevelu.com
HTTP requests captured: 32 · cookies set: 7 · outgoing links: 42
Scan tier: standard · observed 2026-08-21 09:54:08 UTC

Antivirus & YARA (1 of 47 engines)

YARA: ESET research [yara]: IIS_Group10 (page content)

Why this verdict

Antivirus/YARA detection in page content: IIS_Group10
Domain impersonates steam (combosquat)
Certificate issued < 48h ago

Detected technologies

Nuxt.js

Contacted infrastructure

95.129.238.32 DDOS-GUARD LTD (Russian Federation)

Observed indicators

prod.admin.steamlevelu.com
steamlevelu.com
t.me
vk.com
steamcommunity.com
95.129.238.32
https://prod.admin.steamlevelu.com/
https://prod.admin.steamlevelu.com/favicon.ico
https://steamlevelu.com/
https://steamlevelu.com/ru
https://steamlevelu.com/pl
https://steamlevelu.com/zh
https://steamlevelu.com/ua
https://prod.admin.steamlevelu.com/_nuxt/entry.Chhs-5Ds.css
https://prod.admin.steamlevelu.com/_nuxt/headerH1.B3wgO3-g.css
https://prod.admin.steamlevelu.com/_nuxt/CdhBwPJo.js
https://prod.admin.steamlevelu.com/_nuxt/fEVjoApb.js
https://prod.admin.steamlevelu.com/_nuxt/cNOa7sDn.js
https://prod.admin.steamlevelu.com/_nuxt/D8F0jIsH.js
https://prod.admin.steamlevelu.com/_nuxt/tQ_H5wWP.js

Questions about prod.admin.steamlevelu.com

Is prod.admin.steamlevelu.com safe?: No. MalwareAnalyzer scanned prod.admin.steamlevelu.com on 21 Aug 2026 and returned a malicious verdict with a score of 73 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.
How was prod.admin.steamlevelu.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of prod.admin.steamlevelu.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan