s[.]teams-p[.]ru

This domain, s.teams-p.ru, is flagged as a brand impersonation threat specifically targeting Steam, a digital distribution platform for gaming. Analysis indicates the domain was designed to mimic legitimate Steam services, likely to harvest user credentials or distribute malicious payloads under the guise of official communications. No drainer kit signatures were detected in initial scans, but the domain’s infrastructure and registration patterns align with phishing campaigns observed in prior incidents targeting gaming platforms. Infrastructure analysis reveals the following technical indicators: the domain was registered on November 10, 2025, through RU-CENTER-RU, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3 and employs Cloudflare for traffic routing, including HTTP/3 and Cloudflare Browser Insights for performance monitoring. The SSL certificate is issued by Google Trust Services, a common choice for malicious domains due to its free and automated issuance process. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious, while it appears on 2 distinct security blocklists, including PhishDestroy and PhishingDB. The domain’s trust score is 0/100, further corroborating its malicious intent. As of the latest assessment, s.teams-p.ru has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the elevated risk persists due to the domain’s recent creation date and its association with known phishing infrastructure. Organizations and users are advised to block the domain at the network level, including its resolved IP address, and monitor for any attempts to re-register or re-deploy the domain under a different TLD or subdomain. Additional scrutiny should be applied to any communications or redirects involving Steam-related URLs, particularly those leveraging Cloudflare-protected infrastructure.