csmarxet[.]com

This domain, csmarxet.com, has been identified as a credential theft operation targeting users of the CS Market platform, a service for purchasing Counter-Strike: Global Offensive (CS:GO) and Counter-Strike 2 (CS2) in-game items. Analysis indicates the site employs brand impersonation techniques, presenting itself as a legitimate marketplace with the page title 'CS MARKET - Покупайте КС:ГО (CS2) предметы - КС Маркет.' The objective appears to be the unauthorized acquisition of user credentials, likely for subsequent account takeover or resale on underground forums. No evidence of a crypto drainer kit or direct financial theft mechanisms was observed in this instance, though credential harvesting remains a high-impact threat vector for gaming communities.

Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 104.21.13.81, which is part of a content delivery network known to obscure origin infrastructure. Detection metrics indicate limited but targeted flagging: VirusTotal reports 3 out of 95 security vendors marking the domain as malicious, while a single blocklist (PhishDestroy) has incorporated it into its denylist. Google Safe Browsing (GSB) status is not explicitly provided, but the presence on one blocklist suggests partial visibility within the security community.

As of the latest assessment, csmarxet.com has been taken offline, reducing immediate exposure to end users. However, the elevated risk level persists due to the domain's recent registration date, which may indicate preparatory activity for future campaigns. Users who interacted with the site are advised to rotate credentials for associated gaming accounts and enable multi-factor authentication where available. Organizations should monitor for related infrastructure, particularly domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to similar IP ranges, as these may represent ongoing or future credential theft operations.