# PhishDestroy domain threat record: s.team-rf.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/s.team-rf.com/ Machine-readable companion: https://phishdestroy.io/domain/s.team-rf.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 16:20:51 UTC - Last availability or vendor check: 2026-10-25 16:37:23 UTC - Stored record updated: 2026-10-25 23:24:17 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: OpenPhish - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Steam ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Dominet (HK) Limited - Registrar country in stored WHOIS data: US - Registration date in stored WHOIS data: 2026-10-22 07:48:27 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a173ea-df3a-763e-b11c-fb9c74bf452e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/s.team-rf.com - Certificate Transparency search: https://crt.sh/?q=%25.s.team-rf.com - Web Archive lookup: https://web.archive.org/web/*/https://s.team-rf.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored page captures - Primary capture: https://i.ibb.co/R4yCzdMY/10e3505e0166.png Captured: 2026-10-25 16:37:23 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a173ea-df3a-763e-b11c-fb9c74bf452e.png Captured: 2026-10-25 16:37:23 UTC Source report: https://urlscan.io/result/01a173ea-df3a-763e-b11c-fb9c74bf452e/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a17326-e4e7-7150-8dab-7ef53d9a597b.png Captured: 2026-10-25 16:20:51 UTC Source report: https://urlscan.io/result/01a173ea-df3a-763e-b11c-fb9c74bf452e/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2a650360-3176-43d6-9762-a346e6b598ee.png Captured: 2026-10-25 16:27:14 UTC Source report: https://radar.cloudflare.com/scan/2a650360-3176-43d6-9762-a346e6b598ee SHA-256: beca211328fbbbb22256d38a9c9f01c8f82bab0432f90bd52bd2f82dfc483440 - URLQuery: https://screenshots.phishdestroy.io/uq/e0295456-7d6d-4447-ad3c-bd3827142a9a.png Source report: https://urlquery.net/report/e0295456-7d6d-4447-ad3c-bd3827142a9a SHA-256: 206e6f357ca6431e2d2b7f496919762ceec52cddc2bf7acbe31280cbf0c9975f - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17326-e4e7-7150-8dab-7ef53d9a597b.png Captured: 2026-10-25 13:01:41 UTC Source report: https://urlscan.io/result/01a17326-e4e7-7150-8dab-7ef53d9a597b/ SHA-256: de48fc344f97cb0572821e3a2d260108cdcbd0379a6aa07b1c8bab652538f82f - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a173e6-c59b-765b-93c4-77912c0db1a5.png Captured: 2026-10-25 16:31:27 UTC Source report: https://urlscan.io/result/01a173e6-c59b-765b-93c4-77912c0db1a5/ SHA-256: de48fc344f97cb0572821e3a2d260108cdcbd0379a6aa07b1c8bab652538f82f - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a173ef-d122-752d-8893-b8229ca85a92.png Captured: 2026-10-25 16:41:04 UTC Source report: https://urlscan.io/result/01a173ef-d122-752d-8893-b8229ca85a92/ SHA-256: 110a76a7794922dabdfa70ea5adba3cbdd6106d4e8e3be57571fa71489a6b20e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T17:32:13Z", "uuid": "01a173ea-df3a-763e-b11c-fb9c74bf452e", "scanned_at": "2026-10-25T16:35:41Z", "final_url": "https://s.team-rf.com/p/rpt-bvj/bxfsfosw/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://s.team-rf.com/p/rpt-bvj/bxfsfosw", "from": "http://s.team-rf.com/p/rpt-bvj/bxfsfosw", "status": 307 }, { "to": "https://s.team-rf.com/p/rpt-bvj/bxfsfosw/", "from": "https://s.team-rf.com/p/rpt-bvj/bxfsfosw", "status": 301 } ], "ip": "172.67.192.174", "domains": [ "static.cloudflareinsights.com", "i.pinimg.com", "community.steamstatic.com", "community.cloudflare.steamstatic.com" ], "ips": [ "104.16.79.73", "151.101.0.84", "199.232.211.52", "23.33.238.155", "172.67.192.174" ], "asns": [ "13335", "54113", "20940" ], "countries": [ "US", "AU" ], "link_domains": [ "steamcommunity.com", "www.geonames.org" ], "doc_hash": "178fbd76ccd816a3048773c643c5b46a917f46907b991bae490f56edc005976f", "globals": [ "__cfBeacon" ], "tls": { "san": [ "*.team-rf.com", "team-rf.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "team-rf.com", "protocol": "QUIC", "valid_to": "2027-01-20T08:52:09Z", "valid_from": "2026-10-22T08:52:10Z" }, "domain_age_days": 0, "apex_age_days": 3017, "tls_age_days": 3, "tls_valid_days": 89, "requests": 7, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -26, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T16:31:18Z", "uuid": "2a650360-3176-43d6-9762-a346e6b598ee", "scanned_at": "2026-10-25T16:27:14Z", "final_url": "https://s.team-rf.com/", "status": 404, "history": [ { "url": "https://s.team-rf.com/", "status": 404 } ], "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e", "doc_hash": "af06662e89140d29de42f13ba9028ad25919bbd8ec2f1270f92b8ca6466cdc0b", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "s.team-rf.com", "type": "A", "value": "104.21.76.100" }, { "name": "s.team-rf.com", "type": "A", "value": "172.67.192.174" }, { "name": "s.team-rf.com", "type": "AAAA", "value": "2606:4700:3037::6815:4c64" }, { "name": "s.team-rf.com", "type": "AAAA", "value": "2606:4700:3035::ac43:c0ae" } ], "dnssec_valid": false, "ip": "104.21.76.100", "whois": { "registrar": "Dominet (HK) Limited", "created": "2026-10-22T09:48:27Z", "updated": "2026-10-22T09:48:28Z", "expires": "2027-10-22T09:48:27Z", "nameservers": [ "magdalena.ns.cloudflare.com", "rohin.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T23:07:46Z", "analysis_at": "2026-10-25T10:08:34Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 2, "suspicious": 1, "undetected": 36 }, "detections": { "CRDF": "malicious", "Gridinsoft": "phishing", "alphaMountain.ai": "suspicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Information Technology, Suspicious (alphaMountain.ai)" }, "registrar": "Dominet (HK) Limited", "created": "2026-10-22T09:48:27Z", "expires": "2027-10-22T09:48:27Z", "updated": "2026-10-22T09:48:28Z", "first_seen": "2026-10-23T18:12:34Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.76.100" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:c0ae" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:4c64" }, { "ttl": 300, "type": "A", "value": "172.67.192.174" } ], "dns_at": "2026-10-25T10:45:26Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.team-rf.com", "team-rf.com" ], "issuer": "Let's Encrypt / YE2", "serial": "5e2cd1df1d682da47da516b514803ff044c", "sha256": "296bf8dd69ba72f704cdf537c7fd5e2ce9d8c1e508139ed3aba7aa491c07f1f0", "subject": "team-rf.com", "valid_to": "2027-01-20T08:52:09Z", "valid_from": "2026-10-22T08:52:10Z" }, "whois": { "registrar": "Dominet (HK) Limited", "registrar_iana_id": "3775", "registrar_url": "http://www.alibabacloud.com", "created": "2026-10-22T09:48:27Z", "updated": "2026-10-22T09:48:28Z", "expires": "2027-10-22T09:48:27Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "magdalena.ns.cloudflare.com", "rohin.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T16:31:27Z", "caa_records": { "domain": "s.team-rf.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "dns_server": { "ns": [ { "ip": "108.162.194.8", "host": "magdalena.ns.cloudflare.com" }, { "ip": "108.162.195.153", "host": "rohin.ns.cloudflare.com" } ], "zone": "team-rf.com" }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "team-rf.com" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "whois": { "registrar": "Dominet (HK) Limited", "created": "2026-10-22T09:48:27Z", "updated": "2026-10-22T09:48:28Z", "expires": "2027-10-22T09:48:27Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "magdalena.ns.cloudflare.com", "rohin.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } } } } ```