justices[.]team

This domain, justices.team, is flagged as a brand impersonation threat specifically targeting Steam, a widely used digital distribution platform. Analysis indicates the site was designed to deceive users into believing they were interacting with an official Steam storefront, likely to facilitate unauthorized transactions, credential harvesting, or distribution of malicious payloads. The page title, "Магазин: justices.team," suggests a focus on Russian-speaking users, though the scope of the threat may extend beyond this demographic. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The domain is currently offline but was previously detected on one security blocklist and flagged by 2 out of 95 security vendors on VirusTotal. Technologies detected include Ruby on Rails, Cloudflare (including HTTP/3 support), and an SSL certificate issued by Google Trust Services. The domain resolved to the IP address 188.114.96.3, a Cloudflare-operated endpoint commonly used to obfuscate malicious infrastructure. Users who visited justices.team should immediately revoke any sessions or credentials entered on the site, particularly those associated with Steam or linked payment methods. Monitor accounts for unauthorized activity, including transactions, password changes, or linked devices. If financial information was submitted, contact the relevant institution to flag potential fraud. Given the domain’s association with brand impersonation, users should also verify the legitimacy of any communications or promotions received from purported Steam sources during the period the site was active. No direct malware delivery was confirmed, but secondary payloads cannot be ruled out.