market[.]dota2[.]pro

Analysis of market.dota2.pro shows a short‑lived domain created on March 05, 2026 and subsequently taken offline. The site presented the page title "Kirjaudu sisään", which is Finnish for "Log in", indicating an attempt to harvest credentials. The domain was registered through NiceNIC International Group Co., Limited and is hosted on an IP address (185.26.122.18) owned by AS62082 Hostland LTD in Russia. No SSL certificate was observed, meaning traffic was unencrypted and vulnerable to interception.

Infrastructure profiling reveals the authoritative nameservers ns.hostland.ru and ns3.hostland.ru, both consistent with the hosting provider. Reputation data indicates a Gridinsoft trust score of 0 / 100 and a single entry on a security blocklist, suggesting immediate distrust by automated filters. PhishDestroy has actively blocked the domain, and fifteen of ninety‑four VirusTotal security vendors flagged it as malicious, reinforcing the phishing assessment. The lack of HTTPS, low trust score, and multiple independent detections provide concrete evidence of malicious intent.

Uncertainty remains regarding the specific victim demographic and any post‑exploitation payload, as no further content analysis is available. Defenders should add the domain and its associated IP to blocklists, enforce outbound filtering for connections to 185.26.122.18, and monitor for any residual login attempts targeting the "Kirjaudu sisään" endpoint. Incident response teams should also review logs for recent accesses to the domain before its takedown and consider the hosting provider as a potential source of additional related phishing infrastructure.