cs2red[.]net

PhishDestroy has identified cs2red.net as a generic phishing threat targeting users of Counter-Strike 2 (CS2) and Counter-Strike: Global Offensive (CS:GO). The site masquerades as the official CS2RED server platform, displaying a title that translates to 'CS2RED - Official Site of CS2 (CS:GO) Servers - Main Mode Selection Page.' This impersonation is designed to trick players into entering credentials or downloading malicious files, potentially leading to account compromise or crypto drainer activity.

The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with low-reputation domains. It resolves to IP address 188.114.96.3 and uses an SSL certificate from Google Trust Services (WE1), which can lend a false sense of legitimacy. On VirusTotal, 2 out of 95 security vendors flagged the domain as malicious, and it appears on one security blocklist. Google Safe Browsing did not list the site at the time of analysis, but this does not negate the risk.

As of the latest check, cs2red.net has been taken offline, reducing immediate danger. However, users who may have visited the site earlier or provided any information should take precautionary measures. PhishDestroy advises all users to verify the authenticity of any CS2 server websites by checking official community forums or trusted sources. If any credentials were entered on cs2red.net, change them immediately on the legitimate platform and enable two-factor authentication. The domain’s short lifespan and registration patterns suggest it was created specifically for phishing campaigns, and similar domains may emerge in the future.