s[.]team-a[.]xyz

On July 24, 2026 analysts observed that the domain s.team-a.xyz was taken offline but retained a set of indicators that warrant continued monitoring. The domain was registered on February 21, 2026 and resolves to the IP address 47.76.116.249, which is allocated to Hong Kong under ASN 45102 belonging to Alibaba (US) Technology Co., Ltd. The hosting infrastructure therefore leverages a cloud provider frequently abused by threat actors for short‑lived phishing campaigns. The site presented the page title "Сообщество Steam :: alluna," suggesting an attempt to reference the Steam community, though the exact content of the page has not been examined. An SSL certificate identified as "R11" was observed, indicating the use of a self‑signed or low‑trust certificate.

Independent evaluation by Gridinsoft assigned the domain a trust score of 0 out of 100, reflecting a complete lack of confidence in its legitimacy. VirusTotal scanned the domain and 12 of 93 participating security vendors flagged it as malicious, reinforcing the suspicion of abusive activity. The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy service, confirming that at least one defensive platform has incorporated it into its protective ruleset.

The combination of recent registration, low‑trust SSL, minimal detection confidence, and association with a known phishing blocklist elevates its risk profile to the designated elevated level. Defenders should continue to block any traffic to s.team-a.xyz, monitor DNS queries for this name, and consider adding the associated IP address 47.76.116.249 to network‑level deny lists, especially for assets that interact with Steam services. Because the site is already offline, further automated probing is unnecessary, but periodic re‑resolution checks are advised to detect potential re‑hosting or migration to new infrastructure.