skinsmonkey[.]items-join[.]com

The domain skinsmonkey.items-join.com was registered on February 21, 2026 and is currently reported as offline. Infrastructure analysis shows it resolves to the IP address 193.233.232.111, which is geolocated to Germany and advertised under ASN AS210644 belonging to AEZA GROUP LLC. The host presents an SSL certificate issued by the R3 intermediate authority, indicating a standard publicly trusted certificate chain but offering no assurance of legitimacy. The site’s page title is recorded as "Anmelden," and the threat intelligence tags identify it as a brand impersonation campaign targeting the cs2 brand. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious intent.

VirusTotal scans returned detections from 13 of 95 security vendors, and the domain appears on one external blocklist. PhishDestroy has already blocked the domain, confirming active mitigation by at least one anti‑phishing service. The elevated risk level aligns with the observed brand‑impersonation behavior and the low trust score.

While the domain is offline, defenders should continue to monitor the associated IP address and ASN for any re‑use, and ensure that any internal security controls reference the domain, its IP, and the observed SSL fingerprint to block future connections. Organizations should also update URL filtering and email gateway rules to deny traffic to skinsmonkey.items-join.com and to any sub‑domains of items-join.com that resolve to the same host, as the infrastructure may be repurposed for subsequent campaigns. The lack of additional public evidence beyond the listed indicators limits deeper attribution, but the converging signals—brand targeting, multiple vendor detections, blocklist entry, and a zero‑trust score—justify maintaining a heightened defensive posture.