buddakhight[.]onelink[.]me

The domain buddakhight.onelink.me was registered on February 21, 2026 through the OneLink (Branch) service. It is currently classified as a brand‑impersonation campaign targeting the backpack brand. The domain is marked as active and its risk level is under investigation.

Infrastructure analysis shows the domain resolves to the IP address 172.67.193.151, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented is issued by GTS CA 1P5, indicating a standard Cloudflare‑managed certificate. An HTTP request to the domain returns a 403 status code, suggesting that direct access is denied without proper parameters. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. Automated reputation services assign a Gridinsoft trust score of 0 out of 100, reflecting a highly suspicious rating.

The site’s HTML title reads “Trade CS2 (CSGO) Skins ⭐️ Best CS2 (CSGO) Trading Site & Trade Bot — SkinsMonkey,” which is unrelated to the backpack brand and is typical of a lure designed to attract gamers. By masquerading as a legitimate trading platform, the domain attempts to exploit the backpack brand’s reputation to lure victims. VirusTotal currently shows 0 detections out of 95 scanners, but the absence of detections does not imply benign intent, especially given the low trust score and the presence on a phishing blocklist.

Defenders should add buddakhight.onelink.me to outbound and inbound deny lists across web filtering and DNS security solutions. Continuous monitoring of any DNS queries to the domain and correlation with authentication logs for backpack‑related services is advised. Because the hosting is behind Cloudflare, sinkholing the underlying IP may affect legitimate services; therefore, selective blocking at the domain level is recommended. Incident responders should also audit any recent credential use associated with backpack accounts for signs of compromise.