airtrustfastlogistics[.]com[.]fastearnersfx[.]com

The domain airtrustfastlogistics.com.fastearnersfx.com is active as of the report date 23 July 2026 and is being used for a brand‑impersonation campaign targeting Steam users. The site presents a page titled "Login | Airtrust Logistics," a title that does not reference Steam but is consistent with the observed scam type of a Gaming Scam. Technical analysis shows the domain resolves to IP address 198.12.93.82, which is hosted in the United States by HostPapa (AS36352). The server advertises a Let's Encrypt certificate issued under the YR1 identifier, indicating the site is reachable over HTTPS.

Web‑server fingerprints reveal LiteSpeed with HTTP/3 support, and the domain is served from nameservers ns1.megatronserver.com and ns2.megatronserver.com. Registration details indicate the domain was created on 5 June 2024 through Dynadot LLC, suggesting a relatively recent establishment for malicious infrastructure. A Gridinsoft trust score of 0 / 100 reinforces the malicious assessment. The domain appears on one external security blocklist and is explicitly blocked by the PhishDestroy service.

VirusTotal analysis shows that 11 of 95 scanned security vendors have flagged the domain, providing additional independent confirmation of its malicious nature. While the exact page content has not been captured, the combination of brand impersonation, the presence of a login‑oriented page title, and the low trust score strongly suggest credential‑theft intent. Defenders should proactively block both the domain and its resolving IP at network perimeter devices, add the domain to internal DNS sinkhole lists, and monitor for any new subdomains that resolve to the same IP range. Continuous monitoring of threat‑intel feeds for updates to blocklists and for any changes in the hosting environment is recommended to mitigate potential escalation.