buif163[.]com

Analysis of buif163.com shows a short-lived domain created on March 10, 2026 and registered through NiceNIC International Group Co., Limited. The domain resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc., placing the hosting infrastructure within the United States. DNS resolution uses Cloudflare’s authoritative name servers alexis.ns.cloudflare.com and martha.ns.cloudflare.com, indicating reliance on Cloudflare’s CDN and security services. The site employed Cloudflare Browser Insights, HTTP/3, and the Unpkg JavaScript CDN, and the TLS certificate was issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint.

The page title captured by the collection system reads “BUFF — Number one among all skin sites for CS2!”, and the campaign is classified as a brand impersonation targeting the “cs2” brand. VirusTotal scans recorded two detections out of ninety‑five vendors, and the domain has been listed on a single external blocklist. PhishDestroy has also taken the domain offline and marked it as blocked. No additional public threat intelligence sources were referenced in the available data.

Given the observed infrastructure, the domain’s primary malicious intent appears to be the exploitation of the cs2 brand reputation to lure victims. Defenders should add 188.114.97.3 to network denial lists, enforce DNS filtering for buif163.com, and monitor Cloudflare‑associated IP ranges for re‑registration of similar domains. Continuous review of the blocklist status and periodic rescans with VirusTotal or similar services are recommended to capture any future changes. At present, the site is offline, but the rapid creation‑to‑take‑down timeline suggests a low‑latency campaign; therefore, security teams should retain the indicators of compromise for forward‑looking detection.