login[.]cs2booms[.]shop

This domain, login.cs2booms.shop, was flagged for brand impersonation targeting Steam, a gaming platform. Analysis indicates the domain was operational as of the report date (July 23, 2026) but is currently offline. Infrastructure analysis reveals the domain resolved to IP address 172.67.160.37, hosted on Cloudflare's network (AS13335) in the United States. The absence of an SSL certificate and the use of non-standard or unresolvable nameservers (NS_NOT_FOUND) are notable red flags, as these are uncommon for legitimate services. The page title 'Sign In' aligns with typical credential harvesting tactics, though the exact content of the site remains unanalyzed.

Security vendor detections on VirusTotal show 15 of 93 engines flagged the domain as malicious, providing concrete evidence of its suspicious nature. The domain appears on at least one security blocklist, further corroborating its classification as a threat. PhishDestroy has already blocked this domain, indicating prior recognition of its fraudulent intent. The scam type is classified as a gaming scam, consistent with the impersonation of Steam. Defenders should treat this domain as a confirmed threat.

While it is currently offline, the infrastructure (IP, hosting provider) may be reused for future campaigns. Monitoring for re-registration or DNS changes is recommended. If this domain or similar infrastructure appears in logs, it should be investigated for potential credential theft or malware distribution. No further details about the phishing kit or specific payloads are available at this time.