cs2-skin[.]com

The domain cs2-skin.com is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting the brand blast. The site advertises free in‑game items in its page title, which aligns with the impersonation claim. The campaign has been observed since the domain’s creation on 8 March 2025.

Infrastructure analysis shows the domain resolves to IP 192.0.78.25, which belongs to AS2635 owned by Automattic, Inc., and is geolocated in the United States. The domain uses the default WordPress nameservers ns1‑ns3.wordpress.com and presents a Let’s Encrypt YR1 TLS certificate, indicating a recent automated certificate issuance. HTTP requests return a 200 status code, confirming the site is reachable.

Threat intelligence sources corroborate the malicious classification. PhishDestroy has already blocked the domain, and it appears on one public security blocklist. VirusTotal scans have flagged the domain by 10 of 95 security vendors. Reputation services assign a trust score of 1/100 on Scamadviser and 0/100 on Gridinsoft. AlienVault OTX lists the domain in two separate threat pulses. The page title explicitly mentions “FREE SKINS… PROMO CODES,” but no deeper content analysis is available, leaving the exact tactics and user‑interaction mechanisms uncertain.

Defenders should add cs2-skin.com to URL filtering and DNS block lists, especially for networks that allow access to gaming or promotional services. Monitoring outbound traffic for connections to the 192.0.78.25 address can help detect compromised clients. Because the site leverages a legitimate certificate and reputable hosting provider, static SSL pinning is ineffective; instead, behavioral controls and reputation‑based blocking are recommended. Continuous re‑evaluation is advised as further evidence may emerge.