Skip to content
Scammers.com
PhishingReviewed

Fake Steam $50 gift card giveaway at promogiftwinter.com, registered 8 November

PhishDestroy posted on Mastodon on 12 November 2026 that promogiftwinter[.]com is a phishing site. Its record shows a page titled "Steam, The Ultimate Online Game Platform" offering a Steam-branded $50 gift card with…

First reported
Reports
1

Source: mastodon.social · published

Illustration: Phishing, texts and email scams

What happened

PhishDestroy posted on Mastodon on 12 November 2026 that promogiftwinter[.]com is a phishing site. Its record shows a page titled "Steam, The Ultimate Online Game Platform" offering a Steam-branded $50 gift card with a "Get a card" button and a user counter, on a domain registered on 8 November 2026 and hosted at 62.60.226.75; it was flagged by 20 of 92 VirusTotal engines. Fake Steam gift-card pages are commonly used to steal Steam account logins. Valve/Steam is the brand being spoofed and is not involved. The domain is also on the Phishing Army blocklist.

How the scam works

These pages copy a familiar login, payment or delivery form so that a typed password, one-time code, card number or other personal detail goes to the operator rather than to the real company. The address is often a look-alike domain, a newly registered shop, or a free host such as Weebly, Wix, Firebase, Vercel, Workers or Pages. Some kits cloak the real form from scanners and only show it in certain countries or to certain devices. The brand whose name or logo appears is being impersonated and is not involved, unless the report says the page was planted on a compromised official site, in which case only that path is the phishing lure. Open the official app or type the company's real address yourself. If you already entered a password or a card number, change the password on the official site, turn on a new two-factor method, and contact the company and your bank.

Source

Source: https://mastodon.social/@phishdestroy/117602348864696178 (PhishDestroy (@phishdestroy@mastodon.social), Nov 12, 2026, 2:43 AM ET)

Red flags

  • A login, payment or 'verification' page on a look-alike, newly registered or free-hosting address that copies a well-known brand.
  • A message, ad or pop-up that pressures you to sign in, pay or confirm a code through a link.
  • A request for a password, a one-time or 2FA code, a card number, a government ID or a recovery phrase.
  • The real company's name or logo used on a site that is not its official address.

If you were targeted

  1. 1Do not enter passwords, codes or card details on a page you reached from an unexpected message or ad.
  2. 2Open the official app or type the company's real address yourself.
  3. 3If you already entered details, change the password on the official site, review devices and payments, and contact the company and your bank.
  4. 4Report the link to the brand and to your national cyber-crime or CERT service.
ReportFraud.ftc.gov FBI IC3 More resources

Related reports

All phishing reports
Investment fraudReviewed

MalwareTips: mssstock.com's Million Securities claims SEC adviser licence; SEC lists it as exempt, not registered

MalwareTips published an investigation today into Million Securities, which presents mssstock.com as a stock trading platform with wealth management and investment banking services, and whose press releases (distribut…

  • mssstock.com
  • Earlier press-release domain coinln.com; SEC CRD 338838 (Exempt Reporting Adviser, not registered)
  • Unauthorised / AI-trading investment sites flagged 12 Nov 2026
Reported Nov 12, 20261 report
OtherReviewed

Special CBI court remands alleged Mahadev betting-app 'kingpin' Saurabh Chandrakar to judicial custody until 19 November

The Indian Express reported on 12 November 2026 that a special CBI court that day remanded Saurabh Chandrakar, the alleged kingpin of the Mahadev betting app case, to seven days of judicial custody, until 19 November.…

  • Saurabh Chandrakar; Mahadev betting app; special CBI court, Raipur
  • India Enforcement Directorate / CBI financial-crime cases (12 Nov 2026)
Reported Nov 12, 20261 report