dota-market[.]com

PhishDestroy has identified dota-market.com as an active cryptocurrency drainer posing as a Dota 2 gaming market hub. The domain, created April 8, 2025, is engineered to trick users into connecting wallets and transferring funds under false pretenses. It currently shows zero detections on VirusTotal (1/95), likely due to its recent registration and the use of benign infrastructure such as a Let's Encrypt SSL certificate and hosting on Cloudflare’s network (IP 172.67.138.189). Its registrar, NICENIC INTERNATIONAL GROUP CO., LIMITED, has been historically associated with high-risk domain registrations. The site masquerades as a legitimate Dota 2 trading platform, luring gamers into depositing cryptocurrency or linking wallets to purchase in-game items. Once a victim connects a wallet or approves a transaction, the drainer silently transfers funds to attacker-controlled addresses. Evidence of malicious intent is further supported by its complete lack of detection across security vendors, suggesting a newly launched campaign with evasive tactics. The domain’s youth—just days old—indicates a rapidly evolving threat likely targeting enthusiasts during peak gaming activity or events. Users who visited dota-market.com should immediately revoke any wallet connections via their wallet provider’s interface, scan their systems for malware using reputable tools, and avoid re-engaging with the site or similar domains. Disable auto-connect features in wallets and enable transaction alerts. Report the domain to PhishDestroy for inclusion in blocklists to protect the broader community. Blocking the IP 172.67.138.189 at the network level can help prevent further access.