market[.]cs2[.]com[.]ru

Analysis of market.cs2.com.ru indicates a newly registered domain created on 21 February 2026 that is being used for brand impersonation of the cs2 service. The domain resolves to the IPv4 address 89.111.143.197, which is allocated to JSC “RU‑CENTER” under ASN 39494 in Russia. Passive DNS and WHOIS data show the hosting infrastructure is operated by the RU‑CENTER registrar, a common provider for malicious campaigns. An SSL certificate was observed on the host; the certificate rating is listed as “R13”, which suggests a low‑trust or self‑signed certificate.

HTTP requests to the site return a 403 Forbidden status and the page title is explicitly “403 Forbidden”, indicating that the content is currently inaccessible. The site has been taken offline, but prior activity was captured by several security services. VirusTotal recorded five detections out of ninety‑three scanned scanners, and the domain appears on one external blocklist, PhishDestroy, which has already flagged it as malicious. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification.

The threat is categorized as brand impersonation, targeting the cs2 brand, and no additional payload or kit information is available. Uncertainty remains regarding the specific malicious payload or credential‑harvesting mechanisms that may have been hosted before the takedown, as the site was not reachable for content analysis. Defenders should block the domain and its associated IP at perimeter and DNS filtering layers, monitor for any future re‑registration of similar sub‑domains under the cs2 namespace, and incorporate the observed indicators—domain name, IP address, SSL rating, and blocklist entries—into threat‑intel feeds. Continuous observation of the RU‑CENTER ASN for new domains exhibiting similar patterns is also recommended.