casebarttle[.]com

casebarttle[.]com is currently offline but was observed resolving to the Cloudflare‑hosted address 188.114.97.3, an IP owned by AS13335 (Cloudflare, Inc.) located in the United States. The domain was registered on 2026-03-06 through NiceNIC International Group Co., Limited and uses Cloudflare’s authoritative nameservers kip.ns.cloudflare.com and penny.ns.cloudflare.com. No TLS certificate was presented when the site was reachable, indicating that the service was delivered over plain HTTP only. VirusTotal recorded detections from 2 of 94 scanning engines, confirming that at least a minority of security vendors consider the domain malicious.

The site appears on a single security blocklist and is actively blocked by the PhishDestroy feed, providing additional confirmation of its abusive nature. The page title retrieved from the live snapshot reads “CASE-BATTLE — Проверенная CS2 Платформа, созданная для настоящих ценителей крутых скинов!”, which suggests the domain attempted to masquerade as a legitimate Counter-strike 2 skin‑trading platform. No further evidence of the underlying phishing kit, credential‑stealing forms, or malicious payloads has been disclosed. Consequently, the precise tactics employed by the operators remain uncertain, as does the scope of any victim data that may have been harvested.

Defenders should continue to block the domain at network perimeter devices, update DNS filtering policies to include the associated IP address and nameservers, and monitor for any residual traffic to the Cloudflare edge node. Organizations that have users who engage with CS2‑related marketplaces should educate them about the risk of unofficial platforms and advise verification of TLS protection before entering credentials. Incident response teams should also query internal logs for any historic requests to casebarttle[.]com or 188.114.97.3 and, if found, consider credential‑reset procedures and threat‑intel sharing with relevant industry groups.