runeapes[.]team

Analysis of runeapes.team indicates a high‑confidence brand‑impersonation threat targeting Steam users. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑managed address 104.21.53.14, which is associated with ASN 13335 (Cloudflare, Inc.) and located in the United States. Nameserver delegation to brynne.ns.cloudflare.com and kobe.ns.cloudflare.com confirms the use of Cloudflare’s DNS infrastructure. The site presents the page title "RuneApes Labs | Web3 Gaming & NFT Innovation," suggesting a focus on blockchain‑related services, and the technology fingerprint shows Tailwind CSS, Unpkg, Cloudflare and HTTP/3, consistent with a modern web stack but offering no evidence of legitimate Steam content.

No SSL certificate is observed, which is unusual for a site attempting to mimic a reputable brand and may facilitate traffic interception. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 / 100, and six of ninety‑three VirusTotal scanners flag the domain, while it appears on a single security blocklist and is actively blocked by PhishDestroy. The classification as a crypto‑scam aligns with the page title’s emphasis on Web3 and NFT innovation, and the brand target is explicitly listed as Steam, indicating an attempt to lure Steam users into a cryptocurrency‑related fraud.

The domain is currently offline, limiting live content inspection, and no additional evidence such as login pages or phishing kits has been captured. Defenders should continue to block the domain and its underlying IP address, monitor Cloudflare‑associated host ranges for similar registrations, and enforce network‑level filtering for any traffic to runeapes.team. Ongoing reconnaissance of new domains registered through the same registrar or using the same nameserver pair is recommended to pre‑empt future impersonation campaigns.