s[.]team-xcz[.]pro

Analysis of the domain s.team-xcz.pro indicates an active brand‑impersonation campaign targeting the Counter‑Strike community. The site presented a page title of "Steam Community," suggesting an attempt to mimic official Steam pages, and was flagged by 11 of 95 security vendors on VirusTotal. No SSL certificate was observed, leaving the connection unencrypted and exposing any credentials entered. The domain resolved to IP address 104.102.49.106, which is hosted in Germany and belongs to AS16625 operated by Akamai Technologies, a common CDN used by malicious actors to obscure origin.

Registration details show the domain was provisioned through AlexHost (ASN 200019), and the nameserver query returned NS_NOT_FOUND, implying either a misconfiguration or deliberate obfuscation. Reputation scoring from Gridinsoft assigned a trust value of 0 out of 100, reinforcing the malicious assessment. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming that at least one protective service recognized it as hostile.

Current status is offline, indicating the phishing site has been taken down or is no longer serving content. Defenders should continue to block the domain at perimeter filters, update URL and hash‑based blocklists, and monitor the associated IP range for any resurgence. Additional investigation of the Akamai‑hosted IP may reveal related infrastructure, and organizations should enforce MFA and educate users about unsolicited Steam‑related login prompts to mitigate credential harvesting attempts.