steam[.]tw-faceit[.]com

This domain, steam.tw-faceit.com, was taken offline after being identified as a brand‑impersonation site targeting Steam users. The site was registered on 7 November 2025 through Dominet (HK) Limited, and its DNS is hosted on Cloudflare name servers (faye.ns.cloudflare.com, pedro.ns.cloudflare.com). The A record resolves to 172.67.177.181, an IP owned by AS13335 Cloudflare, Inc., located in the United States. No TLS certificate was presented, indicating the site served only HTTP, which is typical for many quick‑deployment phishing infrastructure. The page title returned by the server was “Anmelden”, a German word for “login”, but the content of the page has not been captured, so the exact appearance cannot be verified.

Reputation checks show a Gridinsoft trust score of 0 / 100 and a detection rate of 13 out of 95 scanners on VirusTotal, confirming that multiple security vendors flagged the domain as malicious. The domain appears on one public blocklist and has been added to the PhishDestroy blocklist, reinforcing the assessment that it is being used for a gaming‑related scam. The “Gaming Scam” label matches the observed brand‑impersonation behavior, although no further technical artifacts such as malicious payloads or credential‑harvesting endpoints have been disclosed. For defenders, the immediate recommendation is to ensure that any outbound traffic to 172.67.177.181 is blocked at the network perimeter, and that DNS queries for steam.tw-faceit.com are filtered or redirected to a sinkhole.

Endpoint protection should be updated to include the domain in its URL‑reputation lists, leveraging the 13 vendor detections as a confidence indicator. Because the site is already offline, ongoing monitoring of the registrar (Dominet) for new domains that reuse the same naming pattern or similar sub‑domains is advisable. Analysts should also watch for any resurgence of the “Anmelden” page title in future observations, as it may indicate a repeat of this campaign.