dota2-market-net[.]ru

Analysis indicates that the domain dota2-market-net.ru is currently active and serves a phishing page identified by the title “Dota Market — Купить и продать скины Dota 2 | Дота Маркeт”. The site returns HTTP 200 and presents a valid TLS certificate issued by Let’s Encrypt (renewal identifier YR2). DNS resolution points to the IP address 195.161.68.19, which is advertised as belonging to the Russian network operator RTCOMM. The host has been flagged by the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal reports a single positive detection out of ninety‑one scanners, confirming at least one vendor’s suspicion of malicious activity. The threat is classified as generic phishing with a high risk rating, and the indicator status remains active. Defenders should add the domain and its resolved IP to perimeter deny lists, enforce outbound filtering for TLS connections to the certificate issuer, and monitor network logs for any HTTP 200 responses originating from the IP. Because the page content has not been publicly disclosed, further investigation of the payload and credential‑harvesting mechanisms is recommended. Continuous re‑scanning of the domain on multi‑engine services is advised to capture any changes in detection scores.