lisikins[.]com

The domain lisikins.com was observed hosting a site titled “LIS‑SKINS — Продать Скины CS2 и DotA2 | Официальный Сайт”. The page title indicates a marketplace for Counter‑Strike 2 and Dota 2 skins, a typical lure for credential‑stealing campaigns. The domain resolves to the IPv4 address 58.64.137.69, which belongs to AS17444 HKBN Enterprise Solutions Limited and is geolocated in Hong Kong. No TLS certificate was presented, meaning the site operated over plain HTTP, a common characteristic of low‑cost phishing infrastructure. Registration data shows the domain was created on 5 February 2025 and is registered through NiceNIC International Group Co., Limited.

The authoritative name servers listed include coby.ns.cloudflare.com together with expired‑ns1.niceisp.com, expired‑ns2.niceisp.com, and selah.ns., suggesting a mixed configuration that may have been altered prior to takedown. Multiple security services have flagged the domain. PhishDestroy has placed the domain on its block list, and the domain appears on one additional security blocklist. VirusTotal analysis recorded nine positive detections out of ninety‑four scanning engines, providing independent confirmation of malicious activity. The domain is currently reported as offline, indicating that the hosting content has been removed or the server shut down.

From the available evidence, the infrastructure appears to be a short‑lived phishing operation that leveraged a compromised or rented server in Hong Kong and a modest registration footprint. Defenders should continue to block the domain and the associated IP address at perimeter filters, update threat‑intelligence feeds with the registrar and name‑server details, and monitor for future registrations that reuse the same registrar or similar name‑server patterns. Because the site used no SSL, any attempt to redirect users to HTTPS would be blocked by browsers, but legacy HTTP‑only clients remain vulnerable.