lis-skin[.]site

The domain lis-skin.site has been identified as a phishing platform specifically targeting users of Counter-Strike 2 (CS2) and Dota 2 gaming communities. This domain operates under the guise of selling in-game skins for real currency, a common tactic to harvest account credentials, payment details, and personal information from unsuspecting victims. Analysis confirms the domain is currently offline, though its infrastructure remains a documented threat. Infrastructure analysis reveals the domain was registered on April 18, 2026, through Web Commerce Communications Limited dba WebNic.cc. It resolves to the IP address 185.122.171.30 and is hosted on an Nginx server. Security vendor engagement is notable, with 4 out of 95 VirusTotal vendors flagging the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The Gridinsoft trust score for this domain is 0 out of 100, indicating a complete lack of legitimacy. The page title, written in Russian, explicitly advertises the sale of CS2, CS:GO, and Dota 2 skins for real money, further confirming its fraudulent intent. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure may be reactivated or repurposed for similar phishing campaigns. Organizations and individuals are advised to block the domain and associated IP address (185.122.171.30) at the network level. Users should be educated on recognizing phishing attempts involving in-game item transactions, particularly those offering unrealistic deals or requesting login credentials. Monitoring for related domains registered through the same registrar or resolving to the same IP range is recommended to preemptively mitigate future threats.