marketpllacetf[.]com

On 24 July 2026, marketpllacetf.com was observed as an offline domain used in a brand‑impersonation campaign targeting the “backpack” brand. The domain was registered on 13 September 2025 through Ultahost, Inc. and resolves to the IPv4 address 94.26.255.31, which belongs to AS49505 JSC Selectel in Russia. No TLS certificate is presented for the host, indicating that communications would occur over plain HTTP if the site were reachable. The page title returned by the server, “Securely buy & sell TF2 items – Marketplace.tf”, suggests an attempt to lure victims interested in the Team Fortress 2 marketplace, while the declared brand target is “backpack”.

The domain’s trust score, as measured by Gridinsoft, is 0 out of 100, reflecting a complete lack of reputation. It appears on a single security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal scans show that two of ninety‑five security vendors flagged the domain, confirming that at least a minority of scanners consider it malicious. Nameserver records point to jihoon.ns.cloudflare.com and rafe.ns.cloudflare.com, indicating the use of Cloudflare DNS infrastructure.

The combination of a recent registration, low reputation, Russian hosting, absence of HTTPS, and detection by multiple security products aligns with typical infrastructure used for brand‑impersonation scams. Current evidence does not reveal the exact payload or credential‑collection mechanisms employed, and the site’s offline status prevents a deeper content analysis. Defenders should continue to block traffic to the IP address 94.26.255.31 and to the domain marketpllacetf.com at DNS and proxy layers, monitor for any re‑activation of the domain, and consider adding the domain to internal blocklists. Ongoing observation of related domains registered through the same registrar or using the same nameservers is recommended to detect potential campaign expansion.