5eplay[.]at

The domain 5eplay.at was registered on March 27, 2026 and is currently active. DNS resolution points to the IP address 188.114.96.3, which is hosted by Cloudflare, Inc. and geolocated to Canada. The authoritative nameservers are alexis.ns.cloudflare.com and novalee.ns.cloudflare.com. The site returns an HTTP 301 redirect and presents an SSL certificate issued by Google Trust Services under the WE1 profile, a pattern often used to lend credibility to fraudulent pages. The page title observed in the landing page is "5eplay对战平台 - CS2专业竞技平台 | 赛事数据中心," indicating a focus on a Chinese‑language esports platform, yet the campaign is classified as brand impersonation targeting Google. Analysis of the infrastructure reveals the use of common web‑delivery technologies including YouTube embeds, Bootstrap, jsDelivr, Cloudflare Browser Insights, and HTTP/3, all of which are typical of low‑cost hosting stacks. VirusTotal reports 17 detections out of 94 scanned security vendors, and the domain appears on a single external blocklist, where it is also listed by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. While the exact content of the landing page has not been examined, the combination of a Google‑issued certificate, brand‑targeted classification, and multiple security vendor flags indicates a high‑risk phishing operation. Defenders should block the domain at network perimeters, monitor DNS queries for 5eplay.at, and update endpoint detection rules to include the observed IP address and associated Cloudflare nameservers. Continuous re‑evaluation is recommended as additional intelligence, such as payload analysis or user reports, becomes available.