🎣 Fake login pages and credential harvesting
The page looks exactly like Steam, Discord or your bank. The domain is one letter off. That is the whole trick.
How the scam works
- A link leads to a pixel-perfect copy of a real login page.
- The domain hides the truth: steamcommunity.com.secure-login.top, paypa1.com.
- Your entered credentials go straight to the scammer; you get redirected to the real site, unaware.
Red flags
- Login pages reached through links instead of the official app
- Brand names inside subdomains: steamcommunity.com.anything-else = fake
- Missing HTTPS or freshly registered domains
- Browser warnings about the certificate
What to do
- Type addresses yourself or use the official app — never log in from chat links.
- Check the domain character by character before typing anything.
- Use a password manager: it refuses to autofill on lookalike domains, which is a free scam alarm.
Think you're looking at one right now?
Paste the message or link into the TrustCheck analyzer — it's free and takes seconds. Or add the bot to your Discord server and use /check anywhere.