topsckin[.]com

This domain is flagged for elevated risk due to targeted credential theft operations impersonating CS:GO skin trading platforms. Analysis indicates the site specifically lures Counter-Strike players with promises of instant item withdrawals, a common tactic to harvest Steam login credentials and authentication tokens.

Infrastructure analysis reveals the following technical indicators: VirusTotal detection ratio of 12/95 security vendors, presence on one security blocklist, resolution to IP address 104.21.82.211, and domain registration through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026. The creation date suggests potential domain squatting or pre-registration for malicious purposes, while the Cloudflare-associated IP (104.21.82.211) is frequently observed in phishing infrastructure due to its proxy capabilities. The domain has since been taken offline, though historical DNS records may persist.

Mitigation requires immediate action from both individual users and security teams. Players should revoke any Steam Guard authenticator links associated with this domain and enable two-factor authentication via the official Steam mobile application. Organizations should block the domain and IP at firewall level, add detection rules for the page title pattern (TOPSKIN — Открытие кейсов), and monitor for credential reuse attempts from affected accounts. Security teams should also investigate related domains registered through the same registrar (NICENIC INTERNATIONAL GROUP CO., LIMITED) for similar malicious patterns, particularly those targeting gaming communities with Cyrillic-language content.