pricex2[.]com

This domain, pricex2.com, is confirmed to operate as a credential theft site specifically targeting users of Counter-Strike 2 (CS2) skin trading platforms. Analysis of the page title, 'Sell CS2 Skins Instantly for Real Money | Fast,' indicates an attempt to deceive victims into entering account credentials or payment details under the guise of a legitimate skin trading service. No direct evidence of a cryptocurrency drainer kit was observed, but the infrastructure and social engineering tactics align with credential harvesting campaigns designed to compromise gaming accounts with valuable in-game assets. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.97.3, which is part of a network known for hosting malicious content. Detection metrics show a VirusTotal score of 1/95, indicating minimal but present flagging by security vendors, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and employs technologies such as Node.js, React, Next.js, and Cloudflare, which are often leveraged to obfuscate malicious activity and enhance phishing site performance. As of the latest assessment, pricex2.com has been taken offline, likely in response to blocklist inclusion or manual takedown efforts. However, the elevated risk level persists due to the domain's recent creation, association with a high-risk registrar, and the potential for re-emergence under a different name or IP. Users who interacted with the site are advised to immediately rotate credentials for any linked gaming or financial accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and IP address to prevent future access attempts.