dotamrket[.]com

Analysis indicates that dotamrket.com is an active high-risk domain flagged as part of a generic phishing operation targeting users of the Dota 2 gaming ecosystem. The domain, registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, presents itself as a marketplace for in-game items, as evidenced by its page title in Russian: 'Продавайте и покупайте предметы | Магазин Dota 2.' Infrastructure analysis reveals the domain is proxied behind Cloudflare, resolving to IP address 188.114.97.3 (Canada) and utilizing Cloudflare nameservers (fred.ns.cloudflare.com, mia.ns.cloudflare.com). The site employs a Let's Encrypt SSL certificate (serial E8), which provides encryption but does not validate legitimacy. The domain appears on one security blocklist (PhishDestroy) and is referenced in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious activity. Gridinsoft assigns a trust score of 0/100, reinforcing its suspicious status. While 11 out of 94 security vendors on VirusTotal flag the domain, this detection rate is not conclusive but aligns with broader indicators of compromise. The HTTP status returns 200, confirming the site is currently accessible. Defenders should treat dotamrket.com as an active threat. The combination of Cloudflare proxying, recent registration, and targeted branding (Dota 2) is consistent with phishing infrastructure designed to deceive users into disclosing account credentials or transferring in-game assets. No evidence confirms the exact phishing kit or backend infrastructure, but the domain’s structure and hosting pattern align with known fraudulent marketplaces. Organizations should block this domain at the network level and monitor for related indicators, including the resolved IP and associated SSL certificate. Further analysis of the site’s content and backend connections is recommended to identify additional threat vectors.