steam-gifts.ir - suspicious URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned steam-gifts.ir and returned a suspicious verdict (score 51), categorised as phishing, credential-harvest. The page resolved to 198.105.112.20 on SYN LTD in US. 17 domains and 4 IPs were contacted, over 108 HTTP requests. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 51) · Confidence 60%
- Scanned URL:
https://steam-gifts.ir/ - Domain: steam-gifts.ir · IP: 198.105.112.20 · US
- Server: LiteSpeed
- Page title: فروشگاه استیم گیفت
- HTTP status: 200 · text/html; charset=utf-8
- TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Nov 17 22: · subject CN=steam-gifts.ir
- HTTP requests captured: 108 · cookies set: 2 · outgoing links: 500
- Scan tier: standard · observed 2026-08-21 12:20:24 UTC
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Categories
- phishing
- credential-harvest
Why this verdict
- Domain impersonates steam (combosquat)
- Credential-harvesting form
- Certificate issued < 48h ago
Detected technologies
- LiteSpeed
- PHP
Contacted infrastructure
- 198.105.112.20 SYN LTD (United States)
- 142.250.195.227 - AS15169 Google LLC (India)
Observed indicators
- steam-gifts.ir
- fonts.googleapis.com
- wa.me
- telegram.me
- t.me
- chart.googleapis.com
- go.microsoft.com
- www.bing.com
- www.youtube.com
- www.instagram.com
- steamcommunity.com
- discord.gg
- psbazi.com
- hfnbbbkabnehoejfhcbbhdicagcoobji
- stackpath.bootstrapcdn.com
- fonts.gstatic.com
- www.goftino.com
- 198.105.112.20
- 142.250.195.138
- 104.18.10.207
Questions about steam-gifts.ir
- Is steam-gifts.ir safe?
- No. MalwareAnalyzer scanned steam-gifts.ir on 21 Aug 2026 and returned a suspicious verdict with a score of 51 out of 100, categorised as phishing and credential-harvest. Treat it as hostile until it is re-checked.
- How was steam-gifts.ir checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the standard tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of steam-gifts.ir
Scanned on MalwareAnalyzer by Cyble · Open interactive scan