cgsteama[.]vip

The domain cgsteama.vip was registered on June 19 2025 through Gname.com Pte. Ltd. and currently resolves to the IPv4 address 156.251.25.140, which is advertised as belonging to AS399077 Tcloudnet in the United States. Authoritative name servers are a.share-dns.com, a6.share-dns.com, b.share-dns.net, and b6.share-dns.net, indicating reliance on a shared DNS service. No TLS certificate is presented; the site serves HTTP only, and its HTTP status is reported as taken offline at the time of analysis, limiting immediate interaction but not preventing future activation. Page metadata shows the title "CoinRui" and the domain is classified as a gaming‑related scam that impersonates the Aptos brand.

This classification is reinforced by inclusion on two security blocklists—PhishDestroy and ScamSniffer—and by extremely low reputation scores: Scamadviser 1/100 and Gridinsoft 1/100, both indicating a high probability of fraudulent activity. VirusTotal analysis reports six of ninety‑five antivirus engines flagging the domain as malicious, further corroborating the blocklist findings. Because the site is offline, the exact content, payload, or user‑interaction flow cannot be inspected, leaving the specific phishing kit or command‑and‑control mechanisms unknown.

Defenders should block DNS resolution to 156.251.25.140 and add cgsteama.vip to proxy, firewall, and endpoint deny lists. Monitoring for queries to the listed share‑dns name servers is advised, as is updating threat‑intel feeds with the domain, registrar, and hosting ASN information. Continuous re‑scanning should be scheduled in case the site becomes active again, and any email or URL indicator referencing cgsteama.vip should be treated as malicious.