csmarfet[.]com

This domain, csmarfet.com, is flagged as a counterfeit marketplace phishing site targeting users of the popular first-person shooter game Counter-Strike: Global Offensive (CS:GO) and its successor, Counter-Strike 2 (CS2). The site masqueraded as a legitimate platform for purchasing in-game items, using the page title 'CS MARKET - Покупайте КС:ГО (CS2) предметы - КС Маркет' to deceive Russian-speaking users. Analysis indicates no direct association with known drainer kits, but the domain exhibits characteristics consistent with credential harvesting and payment fraud schemes targeting gaming communities.

Technical indicators reveal the domain was registered through NiceNIC International Group Co., Limited and resolved to the IP address 104.21.12.98, a Cloudflare-protected endpoint. VirusTotal detection metrics show 3 out of 95 security vendors flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain was created on March 05, 2026, an anomalous future date likely indicative of falsified registration data. It appeared on one security blocklist and was not listed in Google Safe Browsing at the time of analysis. Detected technologies include Unpkg, AOS (Animate On Scroll), and HTTP/3, suggesting a modern, responsive frontend designed to mimic legitimate e-commerce platforms.

As of the latest assessment, csmarfet.com has been taken offline, likely in response to security vendor interventions or registrar enforcement actions. However, the elevated risk level persists due to the domain's recent activity and the potential for infrastructure reuse. Users who interacted with the site are advised to reset credentials for associated gaming accounts, enable multi-factor authentication, and monitor financial transactions for unauthorized activity. Organizations should update blocklists to include this domain and its resolved IP, while security teams should investigate potential lateral movement from compromised gaming accounts into corporate environments.