csmartet[.]com

Analysis of csmartet.com indicates that the domain was used for a Counter‑Strike brand impersonation campaign. The site was registered on May 25, 2025 through NiceNIC International Group Co., Limited and hosted on Cloudflare infrastructure, resolving to IP address 104.21.16.1 located in the United States under ASN 13335. The authoritative nameservers listed are gabe.ns.cloudflare.com and sharon.ns.cloudflare.com, confirming the use of Cloudflare's DNS service. No SSL certificate was observed, and the site currently returns an offline status, suggesting that the malicious content has been removed or the host has been taken down.

The page title captured during the brief observation read “CS MARKET – Покупайте КС:ГО (CS2) предметы – КС Маркет”, which aligns with the declared impersonation of the Counter‑Strike brand. Reputation checks give a Gridinsoft trust score of 0/100 and a Scamadviser score of 46/100, both indicating a high likelihood of malicious intent. VirusTotal scans recorded 2 positive detections out of 95 scanning engines, and the domain is listed on a single security blocklist and has been blocked by the PhishDestroy filtering service.

While the offline state limits real‑time threat visibility, the combination of low trust scores, partial VirusTotal detections, and the explicit brand targeting provides sufficient evidence for classification as a confirmed brand‑impersonation site. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the host IP, and consider adding the domain to local deny lists. Additional investigation may focus on any residual DNS records or cached content that could reveal credential‑stealing infrastructure still in use.