greencase[.]ink

This domain is flagged for hosting a counterfeit CS2 case opening platform, a specific phishing threat targeting users of gaming-related services. The risk level is elevated due to its association with fraudulent schemes designed to harvest credentials or financial information under the guise of in-game rewards or virtual item trading. Analysis indicates the domain greencase.ink was registered on May 29, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 172.67.146.115 and was detected by 20 out of 95 security vendors on VirusTotal. The domain appears on at least one security blocklist and was actively blocked by a phishing-specific detection system. Infrastructure analysis reveals the use of Cloudflare for hosting and protection, including Cloudflare Browser Insights and HTTP/3 protocols. The SSL certificate was issued by Let's Encrypt, a common but not exclusive indicator of legitimate domains. The page title, CS2 case opening, aligns with known phishing tactics targeting gaming communities. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address within network security controls. Organizations should update endpoint protection rules to flag or quarantine any attempts to access greencase.ink or similar domains. Users should be educated on recognizing fraudulent gaming reward schemes, particularly those promising free or discounted in-game items. Monitoring for credential theft or financial fraud linked to this domain is recommended, as phishing victims may experience secondary attacks. Security teams should review logs for prior connections to the IP 172.67.146.115 or related infrastructure to identify potential compromise.