counter-strike2[.]xyz

Analysis of counter-strike2.xyz indicates a confirmed brand impersonation campaign targeting Counter-Strike 2 (CS2) users. The domain was registered on January 5, 2025, through NameCheap, Inc., and was taken offline by July 24, 2026. Infrastructure analysis reveals it resolved to 38.244.152.253, hosted on AS200088 (Artnet Sp. z o.o.) in Poland, with no SSL certificate present.

The page title, 'Counter Strike 2 - Официальный сайт,' explicitly impersonates the official CS2 platform, using Russian text to suggest legitimacy. Detection data shows the domain was flagged by 3 of 95 security vendors on VirusTotal and appears on 2 security blocklists, including PhishDestroy and DiscordPhishing. AlienVault OTX lists it in 4 threat intelligence pulses, further corroborating malicious intent. The domain's Gridinsoft trust score of 0/100 aligns with its classification as a brand impersonation scam.

Defenders should treat this domain as a confirmed threat vector for CS2-related phishing, particularly targeting Russian-speaking users. No evidence of active exploitation remains, as the site is offline, but historical DNS and WHOIS records should be preserved for retrospective hunting. Additional scrutiny is warranted for related infrastructure, including the hosting provider and registrar, given their association with this campaign.