cs2mora[.]sbs

cs2mora.sbs presents a high risk due to its specific threat of brand impersonation targeting the CS2 gaming community. The site was designed to mimic legitimate CS2 skin trading platforms, likely aiming to harvest user credentials or deploy crypto drainers. Although currently offline, the domain's recent creation and suspicious registration details indicate a clear intent to defraud users.

Technical analysis reveals multiple red flags. The domain was created on June 22, 2025, and registered through Web Commerce Communications Limited, a registrar often associated with questionable domains. It resolves to IP address 88.151.192.141 and lacks an SSL certificate, making any data transmission insecure. VirusTotal data shows 3 out of 95 security vendors flagging this domain as malicious, and it appears on one security blocklist. The page title "WO Christie Ltd - Trade CS:GO Skins" is a clear attempt to impersonate legitimate trading services, despite CS2 being the successor to CS:GO.

Users who may have encountered this site before it was taken offline should take immediate action. If any credentials were entered, change passwords for CS2 accounts and any other services using the same credentials. Enable two-factor authentication on all gaming and email accounts. Monitor accounts for unauthorized transactions or login attempts. For future safety, always verify the legitimacy of trading sites through official channels and use PhishDestroy to check URLs before interacting with them. Avoid sites that lack HTTPS or have recently created domains with suspicious registrars.