si[.]team-cnw[.]com

Analysis of the domain si.team-cnw.com, created on 21 February 2026, indicates it was employed in a generic phishing campaign targeting Steam users, as suggested by the page title “Steam Community :: Alice”. The site resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The SSL certificate presented under the identifier “WE1” further confirms the use of Cloudflare’s TLS termination service. VirusTotal recorded six detections out of ninety‑three scanned security vendors, providing modest but notable malicious indication.

The domain appears on a single active blocklist, PhishDestroy, which has already taken the domain offline. No additional intelligence such as Safe Browsing verdicts, OTX references, or registrar details were supplied. The limited detection surface suggests that the campaign was short‑lived or otherwise low‑profile. Defenders should continue to monitor the associated IP address and Cloudflare ASN for any new domains that exhibit similar characteristics, especially those that resolve to the same IP or present comparable page titles referencing Steam.

Updating local blocklists with the reported domain and configuring web filtering to deny connections to 188.114.96.3 can mitigate residual risk. Because the site is currently offline, active mitigation is limited to preventive controls. Ongoing vigilance is advised, as the underlying hosting infrastructure remains a common vector for rapid phishing deployments.