steampay[.]cfd

The domain steampay.cfd is associated with a brand impersonation phishing scheme targeting users of the Steam platform. It has been identified as a scam site that mimics the appearance of Steam to deceive users into providing sensitive information. Currently, the site has been taken offline, reducing immediate risk, but users who interacted with the site should remain vigilant.

Several technical indicators highlight the malicious nature of steampay.cfd. The domain was flagged by 2 of 95 security vendors on VirusTotal, specifically Fortinet and Seclookup. It was created on February 22, 2026, and is registered through NiceNIC International Group Co., Limited. The IP address associated with the domain is 85.192.49.195, located in Finland. The domain's SSL certificate was issued by Let's Encrypt / R13. It appears on one security blocklist, specifically PhishDestroy, indicating its involvement in phishing activities. Additionally, the site's page title, 'SteamPay — Мгновенное пополнение Steam в России', suggests a focus on the Russian-speaking market.

Users who may have interacted with steampay.cfd should take immediate steps to secure their accounts. This includes changing passwords associated with Steam and any other accounts using the same credentials, enabling two-factor authentication where possible, and monitoring for unauthorized transactions or activity. To report phishing attempts related to this domain, users can contact Steam Support directly or report the site to organizations that track phishing sites, such as PhishDestroy.