login[.]cs2-final[.]net

The domain login.cs2-final.net was registered on February 21, 2026 through the REGRU-RU registrar and is currently reported as taken offline. DNS resolution points to IP address 104.21.40.47, which is allocated to the United States and owned by AS13335 Cloudflare, Inc. The authoritative nameservers are abdullah.ns.cloudflare.com and val.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. No SSL/TLS certificate is presented for the host, meaning connections are not encrypted and the lack of a certificate is itself a security indicator. The site’s HTTP response includes a page title of "Sign In," matching the observed brand target of Steam, and the intelligence classifies the activity as a Gaming Scam that impersonates the Steam brand.

VirusTotal analysis shows that 16 of 93 scanning vendors flagged the domain, indicating a moderate to elevated detection consensus among commercial scanners. Additionally, the domain appears on a single external security blocklist and has been listed by the PhishDestroy blocklist service. The combination of a recent registration date, Cloudflare‑hosted IP, absent TLS, and multiple vendor detections suggests a purpose‑built impersonation campaign rather than an accidental misconfiguration.

However, the offline status prevents real‑time verification of payload delivery or credential harvesting mechanisms, leaving the exact malicious behavior uncertain. Defenders should add login.cs2-final.net to blocklists at the DNS, proxy, and endpoint layers, monitor traffic to its resolving IP for any anomalous requests, and consider tightening SSL inspection policies to catch unencrypted attempts. Continuous re‑evaluation is advised in case the domain is re‑activated or mirrors the observed pattern in future campaigns targeting Steam users.