winter-gifts[.]cfd

winter-gifts.cfd was registered on December 12, 2025 through ERANET INTERNATIONAL LIMITED. The domain resolves to the Cloudflare edge address 172.67.163.90, which belongs to ASN 13335 owned by Cloudflare, Inc., and the DNS configuration lists bayan.ns.cloudflare.com and sierra.ns.cloudflare.com as authoritative nameservers. No SSL certificate is presented for the site, indicating that HTTPS is not enforced. The page title observed in prior scans is “Steam Gift Activation,” and the domain is explicitly listed as impersonating the Steam brand, classifying the operation as a gaming‑related scam.

Threat intelligence sources show that the domain appears in two AlienVault OTX pulses and has been flagged by PhishDestroy, as well as being present on a single public security blocklist. On VirusTotal, 16 of 95 scanned security vendors flagged the host as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The current operational status is offline, so no live HTTP response can be verified at the time of this report.

Evidence suggests the site was used to lure victims into entering Steam gift codes or personal credentials, though the exact payload is not publicly disclosed. Defenders should add the domain and its resolved IP address to blocklists, monitor DNS queries for the Cloudflare nameservers, and ensure that any Steam‑related credential or code entry controls are hardened against unsolicited inputs. Continuous ingestion of the OTX pulses and PhishDestroy feeds is recommended to capture any future re‑hosting attempts. Because the domain lacks TLS protection and carries a zero trust rating, it should be treated as high‑confidence malicious and excluded from any allowlist.