market[.]old-csgo[.]com

Analysis of market.old-csgo.com identifies it as an active phishing domain targeting users of the Counter-Strike: Global Offensive (CS:GO) skin trading ecosystem. The domain was registered on April 15, 2026, through RU-CENTER and is hosted on IP 89.111.143.197, operated by SpaceWeb Ltd in Russia. Nameservers point to ns1.spaceweb.ru, ns2.spaceweb.ru, ns3.spaceweb.pro, and ns4.spaceweb.pro, consistent with known phishing infrastructure patterns observed in Eastern European hosting providers. The page title, 'CSGO Market old version - купить скины кс го, продать скины кс го,' explicitly references CS:GO skin purchasing and selling, indicating an attempt to deceive users into believing the site is a legitimate marketplace for in-game items. As of July 13, 2026, the domain remains active with an HTTP 200 status, suggesting ongoing operational use. A Let's Encrypt SSL certificate (R12) is present, which is commonly abused by threat actors to lend false legitimacy to phishing sites. Security vendors have flagged the domain, with 12 of 94 engines on VirusTotal detecting it as malicious. It is also listed on the PhishDestroy blocklist. The Gridinsoft trust score of 0/100 further corroborates its classification as high-risk. While the exact phishing kit or payload is not yet analyzed, the domain's infrastructure, registration details, and targeting of a specific gaming community align with credential harvesting or fraudulent transaction schemes. Defenders should treat this domain as confirmed malicious. Network-level blocking of 89.111.143.197 and the associated nameservers is recommended. Security teams should monitor for user reports of CS:GO-related phishing attempts and correlate any incidents involving this domain. Further analysis of the site's backend or associated malware samples may provide additional indicators of compromise.