cybershoske[.]com

Analysis of cybershoske.com indicates a high-risk domain impersonating a Counter-Strike 2 (CS2) gaming platform. The domain, registered on March 13, 2025, through NiceNIC International Group Co., Limited, currently resolves to IP address 172.67.192.249, hosted on Cloudflare's infrastructure (AS13335). The page title explicitly claims affiliation with CS2 servers, suggesting an attempt to deceive users into engaging with a fraudulent gaming service. Infrastructure analysis reveals the use of Cloudflare nameservers (jo.ns.cloudflare.com, steven.ns.cloudflare.com) and technologies including Unpkg, Cloudflare Browser Insights, AOS, and HTTP/3, which are consistent with modern phishing or scam operations leveraging content delivery networks for obfuscation and resilience. The domain is flagged on one security blocklist and has been detected by 5 of 94 security vendors in a recent scan, confirming its malicious classification. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as fraudulent domains frequently use valid certificates to appear legitimate. While the exact content and mechanics of the scam remain unconfirmed due to the absence of deeper page analysis, the combination of impersonation, recent registration, and security vendor detections strongly suggests an active phishing or credential-harvesting campaign targeting CS2 players. Defenders should treat this domain as hostile and implement blocking measures at the DNS or network level. Monitoring for additional indicators, such as related domains or IP associations, is recommended to identify potential campaign expansion. Given the domain's continued activity and Cloudflare hosting, takedown efforts may require coordination with the hosting provider.