csmaqket[.]com

This domain, csmaqket.com, is identified as a credential theft operation targeting users of the CS Market platform, which facilitates the purchase of Counter-Strike 2 (CS2) in-game items. The site impersonates the legitimate CS Market service, presenting a Russian-language interface with the page title 'CS MARKET - Покупайте КС:ГО (CS2) предметы - КС Маркет,' designed to deceive users into entering account credentials or payment details under false pretenses. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting tactics commonly used to compromise gaming accounts and linked financial services. Analysis indicates the domain was registered on March 05, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk registrations. The domain resolves to the IP address 104.21.74.72, which is part of a content delivery network (CDN) range often exploited to obfuscate malicious infrastructure. As of the latest assessment, VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The domain's creation date is anomalous, suggesting either a typo-squatting attempt or a placeholder for future malicious activity, though its current operational status confirms active abuse. The domain has since been taken offline, likely in response to detection and reporting by security vendors. However, the remaining risk persists due to the potential for re-registration or migration to a new domain under similar naming conventions. Users who interacted with the site are advised to immediately reset credentials for any associated accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its resolved IP, while security teams are recommended to investigate related infrastructure for additional compromise vectors.