buffw163[.]com

Analysis of the domain buffw163.com indicates it was actively impersonating the CS2 brand as part of a phishing operation. The domain was registered through the RIPE NCC registry and resolved to the IP address 172.217.16.196, hosted on Google LLC infrastructure (AS15169) in the United States. At the time of assessment, the site was offline, with no SSL certificate present and only a single nameserver configured. The page title captured during initial scans was 'buf163 - Cerca con Google,' suggesting a search-related or redirect mechanism, though the exact content and functionality remain unconfirmed due to the site's current unavailability.

The domain appeared on one security blocklist and was blocked by PhishDestroy, though no additional vendor detections were recorded at the time of analysis. Third-party trust scores from Scamadviser and Gridinsoft rated the domain at 20/100 and 0/100, respectively, reflecting low confidence in its legitimacy. While no detections were reported by the 95 vendors that scanned the domain via VirusTotal, the absence of flags does not confirm safety, particularly given the domain's association with brand impersonation.

Defenders should treat buffw163.com as part of a CS2-themed phishing infrastructure, particularly if logs or telemetry indicate user interactions with the domain prior to its takedown. Monitoring for re-registration or re-emergence under similar naming conventions (e.g., variations of 'buff' or '163') is recommended. Organizations targeting CS2-related threats may prioritize this domain for inclusion in blocklists or threat intelligence feeds, particularly if additional evidence of malicious activity emerges.