dotabuff[.]at

Analysis of the domain dotabuff.at reveals a confirmed credential phishing operation targeting users of the legitimate Dota 2 analytics platform Dotabuff. The domain, registered on March 22, 2026, through Hosting Concepts B.V. via Registrar.eu, resolves to the IP address 188.114.97.3 and presents an exact replica of the authentic Dotabuff interface, as indicated by its page title 'Dotabuff - Dota 2 Analytics.' This mimicry is a common tactic to deceive users into entering login credentials or other sensitive information. Technical indicators strongly suggest malicious intent. The domain is flagged by 2 out of 95 security vendors on VirusTotal and appears on four distinct security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. Additionally, AlienVault OTX lists the domain in 23 threat intelligence pulses, further corroborating its association with malicious activity. Infrastructure analysis reveals the use of Cloudflare and Let's Encrypt SSL certificates, which are frequently leveraged by threat actors to obscure malicious traffic and lend a false sense of legitimacy to phishing sites. The presence of Cloudflare Browser Insights and HTTP/3 also aligns with techniques observed in other credential harvesting campaigns. The domain remains active as of July 12, 2026, and has not been remediated or taken down by its hosting provider. While the exact phishing kit or payload remains unconfirmed, the combination of domain spoofing, blocklist presence, and threat intelligence pulses leaves little doubt about its malicious purpose. Defenders should treat this domain as a high-risk indicator and prioritize blocking it at the network and endpoint levels. Organizations should also monitor for any authentication attempts originating from this domain, as compromised credentials may be used in subsequent attacks. Given the domain's recent registration and active status, continued vigilance is warranted.