explorersa[.]onelink[.]me

The domain explorersa.onelink.me is a confirmed phishing site engaged in brand impersonation targeting the 'blast' platform. It poses as a legitimate service to deceive users into disclosing Steam account credentials, classified under 'steam_phish' scams. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate risk to users.

Technical indicators show explorersa.onelink.me was registered through OneLink (Branch) on February 21, 2026, with a creation date notably in the future, suggesting potential inaccuracies or manipulation. It resolved to IP address 104.20.19.108, hosted on Cloudflare in the US (AS13335). Security scans revealed 0 of 95 VirusTotal vendors flagged the domain, and Google Safe Browsing did not detect it. However, it appeared on 1 security blocklist (PhishDestroy), and Gridinsoft assigned a trust score of 0/100. The SSL certificate was issued by E1, and the observed page title was 'CS.MONEY — Trading Bot for fast CS:GO/CS2 skins trade', unrelated to the impersonated brand.

Users who interacted with explorersa.onelink.me should immediately change their Steam account passwords and enable two-factor authentication to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized trades or logins. Report the phishing domain to Steam support and file complaints with the registrar (OneLink) and security blocklists like PhishDestroy. If financial loss occurred, contact local cybercrime authorities or platforms like IC3 or Action Fraud.