gamdom-tr[.]com

Analysis of the domain gamdom-tr.com indicates a targeted brand impersonation campaign aimed at users of the CS2 gaming platform. The domain was registered on February 21, 2026, through NameSilo, LLC, and resolves to the IP address 188.114.97.3, which is hosted on Cloudflare's infrastructure (AS13335, United States). The nameservers, mallory.ns.cloudflare.com and miguel.ns.cloudflare.com, further confirm Cloudflare's involvement in the domain's hosting and traffic routing. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare's services. As of the report date, the domain is offline, though it was previously flagged by three security vendors on VirusTotal, including PhishDestroy, MetaMask, and SEAL.

It appears on three security blocklists and has been documented in one AlienVault OTX threat intelligence pulse, suggesting prior malicious activity. The page title, 'Gamdom Giriş : Gamdom TR ile bahsinize başlayın - Gamdom,' explicitly references the Gamdom brand, aligning with the observed scam type of brand impersonation targeting CS2 users. Gridinsoft assigns the domain a trust score of 0/100, reinforcing its classification as high-risk. Infrastructure analysis reveals the use of HTTP/3, a protocol often employed to evade detection or improve performance, though its presence alone is not indicative of malicious intent.

The domain's registration age (approximately five months at the time of takedown) and its abrupt offline status may suggest enforcement action or voluntary abandonment following detection. Defenders should treat this domain as part of a broader pattern of CS2-related phishing, particularly those impersonating gaming or gambling platforms. While the exact content of the site remains unanalyzed, the available evidence—including the page title, brand target, and detection by multiple security vendors—supports its classification as a phishing domain.