eslmasters22[.]com

The domain eslmasters22.com was registered on 2025-10-03 through MAT BAO CORPORATION and immediately configured to use Cloudflare nameservers candy.ns.cloudflare.com and carter.ns.cloudflare.com. DNS resolution points to IP address 91.200.14.203, which belongs to AS209641 I‑SERVERS LTD and is geolocated in Russia. No TLS certificate is present on the host, indicating that the site served HTTP only. The page title returned during the brief live period was "ESL Pro League – Season 22", matching the brand target "counter‑strike" and confirming a brand‑impersonation motive.

The site was detected by PhishDestroy and subsequently taken offline, but it remains listed on at least one public security blocklist. VirusTotal analysis recorded 14 positives out of 95 scanners, and AlienVault OTX references the domain in sixteen threat‑intel pulses, reinforcing the malicious classification. Reputation services assign extremely low trust scores, with Scamadviser rating 1/100 and Gridinsoft 0/100. These metrics, combined with the observed infrastructure and branding clues, strongly indicate that eslmasters22.com was used to lure victims by masquerading as an official ESL Pro League portal for the Counter‑Strike esports scene.

Evidence gaps include the specific payload or credential‑harvesting mechanism, as no page content was captured before the takedown. Analysts should continue to monitor the IP address for re‑use, enforce blocking of the domain and its resolver IP at network perimeters, and add the host to internal threat‑intel feeds. Correlation with the sixteen OTX pulses may reveal additional campaigns sharing the same infrastructure. Until further forensic artifacts become available, the domain should be treated as a confirmed brand‑impersonation threat targeting the Counter‑Strike community.