Your Free CS2 Skins Are a Lie: 1,133 Steam Phishing URLs Found Today
- Patrick Duggan
- Dec 27, 2025
- 2 min read
Updated: Aug 11
--- title: "Your Free CS2 Skins Are a Lie: 1,133 Steam Phishing URLs Found Today" date: 2025-12-27 author: Patrick Duggan tags: [advisory, phishing, steam, gaming, clearfake, threat-intel] ---
The Campaigns Running Right Now
While you're recovering from Christmas, three active phishing campaigns are harvesting credentials. Our automated threat intelligence detected them today. Here's what to watch for.
Campaign 1: Fake Steam CS2 Skin Giveaways
1,133 phishing URLs detected
The domain `steamcomnmunity.com` (note the extra 'n') is pushing fake Counter-Strike 2 skin promotions. The lure is always the same: free Mirage skins, holiday giveaways, "apology" codes.
• Real Steam: `steamcommunity.com`
• Fake Steam: `steamcomnmunity.com`
That single extra letter is the difference between your account and someone else's.
Campaign 2: ClearFake via .qpon Domains
56 malicious domains detected
The `.qpon` TLD exists for one reason: to look like "coupon" to your brain. Today's variant uses `savefalke.qpon` with randomized subdomains:
• `hhgyqyai.savefalke.qpon`
• `r4ojz98h.savefalke.qpon`
• `yhkd41e4.savefalke.qpon`
These are ClearFake payload delivery domains. They push fake browser updates that install malware.
The pattern: Random subdomain + legitimate-looking parent domain + sketchy TLD = malware.
Campaign 3: Quasar RAT via Portmap
166 C2 domains detected
Portmap.host provides free port forwarding - and attackers love it for command-and-control infrastructure:
• `tspmo-40154.portmap.host`
• `wawreal-42593.portmap.host`
• `sosato-31557.portmap.host`
These are Quasar RAT command servers. If your machine is calling these domains, you're already compromised.
Why This Matters Now
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
Post-holiday emails are expected. "Sorry for the delay" is normal. "Here's a discount code" feels real.
Attackers know this. The apology-coupon play works because: 1. You're tired from the holidays 2. You expect delays and apologies 3. A coupon feels like compensation 4. Your guard is down
What To Do
1. Check URLs carefully - one letter changes everything 2. Ignore unsolicited discount codes - legitimate companies don't send apology coupons via sketchy domains 3. Block these TLDs at your firewall: - `.qpon` - `portmap.host` 4. Check our STIX feed - machine-readable IOCs for all 1,355 indicators: analytics.dugganusa.com/api/v1/stix-feed
The Data
• PreCog Sweep: Novel IOC detection
• Feed Harvest: OpenPhish, ThreatFox, AbuseIPDB correlation
• STIX 2.1: Machine-readable output for your SIEM
All indicators are freely available via our Democratic Sharing Law commitment.
*Detection timestamps: 2025-12-27 17:57-19:00 UTC* *Sources: OpenPhish, ThreatFox, PreCog autonomous hunting*
Get Free IOCs
Subscribe to our threat intelligence feeds for free, machine-readable IOCs:
AlienVault OTX: https://otx.alienvault.com/user/pduggusa
STIX 2.1 Feed: https://analytics.dugganusa.com/api/v1/stix-feed
Questions? [email protected]
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=untitled-blog-post-2
Comments