lisskins[.]click

This domain, lisskins.click, is flagged as a high-risk phishing site targeting users of gaming skin marketplaces. Registered on March 14, 2026, through Sav.com, LLC, the domain resolves to the IP address 80.89.224.136 and uses a Let's Encrypt SSL certificate for encryption. The page title, written in Russian, explicitly advertises the sale and purchase of skins for CS2, Dota 2, and Rust with instant payouts, indicating a likely fraudulent scheme aimed at gamers seeking virtual item transactions. Analysis indicates the domain remains active as of July 12, 2026, despite being detected by multiple security mechanisms. It appears on two security blocklists and has been included in 24 threat intelligence pulses on AlienVault OTX. Additionally, 16 out of 95 security vendors on VirusTotal have flagged the domain, reinforcing its classification as malicious infrastructure. The domain's trust score from Gridinsoft is 0 out of 100, further supporting the assessment of high risk. While the exact mechanics of the scam are not yet analysed due to the absence of direct website inspection, the combination of a recent registration date, active security vendor detections, and a page title explicitly targeting gaming communities aligns with known patterns of phishing operations. The use of a Let's Encrypt certificate does not mitigate the risk, as such certificates are commonly exploited by threat actors to lend a false sense of legitimacy to malicious sites. Defenders should treat this domain as confirmed malicious infrastructure and implement blocking measures at the network and endpoint levels. Given its persistence in threat intelligence feeds and active status, monitoring for related domains or IP associations may help identify broader campaign infrastructure. No brand impersonation beyond the gaming skin marketplace context is evident from the available data, but the site's content and targeting suggest a focus on defrauding users within that ecosystem.