s[.]team-yh[.]com

This domain, s.team-yh.com, is actively flagged as a high-risk brand impersonation threat targeting Steam users. Registered on February 21, 2026, through Web Commerce Communications Limited (WebNic.cc), the domain remains operational with an HTTP status of 200, indicating an accessible web server. Infrastructure analysis reveals it resolves to 194.87.216.152, hosted on AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) in the Netherlands. The domain is served by nameservers ns100.webnic.cc and ns101.webnic.cc, consistent with the registrar’s infrastructure, which may facilitate rapid domain cycling or evasion tactics. Security vendor detections provide further evidence of malicious intent. As of the latest assessment, 15 out of 95 security vendors on VirusTotal classify this domain as malicious, while it appears on two independent blocklists: PhishDestroy and PhishingDB. The SSL certificate, identified as E8, offers no additional trust indicators, as Gridinsoft assigns the domain a trust score of 0/100. The scam type is explicitly categorized as impersonation, directly targeting Steam, though the exact content or mechanisms of the phishing kit remain unconfirmed due to lack of on-site analysis. Defenders should prioritize blocking this domain at the DNS and network layers, particularly in environments where Steam-related services are accessed. The use of WebNic.cc for registration and the hosting provider’s low-reputation ASN suggest a pattern consistent with phishing campaigns designed for short-term abuse. Given the domain’s recent creation and active status, monitoring for related domains using similar naming conventions (e.g., Steam-themed subdomains) or shared infrastructure (nameservers, IP ranges) is recommended. No evidence currently links this domain to broader malware distribution or command-and-control activity, but its continued accessibility warrants immediate containment.