# market-dota2.cs2rate.com — SUSPICIOUS

> PhishDestroy identifies market-dota2.cs2rate.com as a Dota 2 skin phishing lure. Resolves to 217.149.31.

## Summary
PhishDestroy identifies market-dota2.cs2rate.com as an active Dota 2 skin-phishing domain posing as a trading marketplace. The page mimics legitimate CS2/Dota 2 item storefronts to harvest Steam credentials and session tokens. Alert levels remain under investigation pending further behavioral analysis, but user submissions confirm active lure pages targeting the Dota 2 community.    Flagged by 0 of 95 VirusTotal vendors (clean at time of analysis), the domain was registered through NameSilo, LLC on 2025-01-29, resolving to IPv4 address 217.149.31.235. An auto-issued Let’s Encrypt certificate supports HTTPS, complicating simple blocklisting and heightening risk of successful credential theft. Current passive DNS and threat-intel feeds show zero prior detections, placing the domain in the early stages of malicious use.    Analysts recommend parsing DNS logs for queries to market-dota2.cs2rate.com and adjacent patterns (cs2rate.com subdomains) across endpoints where Dota 2 or Steam clients run. Immediately revoke any exposed credentials, rotate API keys tied to the Steam account, and deploy browser policies blocking the base domain and resolving IP. Conduct phishing-awareness drills targeting Steam users within your organization, ensuring 2-factor authentication is enabled and Steam Guard mobile authenticator is active.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-01-29 18:39:36
- Registrar: NameSilo, LLC
- IP: 217.149.31.235

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/market-dota2.cs2rate.com
- PhishDestroy: https://phishdestroy.io/domain/market-dota2.cs2rate.com/
- LLM endpoint: https://phishdestroy.io/domain/market-dota2.cs2rate.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/market-dota2.cs2rate.com/
Last updated: 2026-04-08