lis-skins[.]com[.]ru

This domain, lis-skins.com.ru, is flagged as an active phishing site targeting users of Counter-Strike 2 (CS2), Counter-Strike: Global Offensive (CS:GO), and Dota 2. The page title explicitly advertises the sale of in-game skins for real money, a common lure for fraudulent trading platforms. Analysis indicates the domain was registered on April 25, 2026, and remains operational as of July 12, 2026, with a trust score of 0/100 from Gridinsoft and detection by one security blocklist. The site resolves to IP address 89.111.143.197, hosted by SpaceWeb Ltd in Russia, and uses nameservers ns1.reg.ru and ns2.reg.ru. Infrastructure analysis reveals the use of Nginx as the web server and Google Tag Manager for tracking, alongside a Let's Encrypt SSL certificate issued under the R13 intermediate. The HTTP status returns 200, confirming the site is accessible. While VirusTotal shows only 1 of 95 security vendors flagging the domain, this does not diminish the risk given the domain's recent creation, low trust score, and active blocklist status. The exact nature of the fraud remains unconfirmed due to limited analysis of the site's content. However, the advertised service—trading in-game skins for real currency—aligns with known phishing tactics, including fake marketplaces, account takeovers, or payment scams. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Monitoring for associated IP addresses, nameservers, or SSL certificate patterns may help identify related threats. Further investigation into user reports or transaction logs is recommended to assess potential financial or credential exposure.