cs[.]money-stats[.]com

The domain cs.money-stats.com was identified as a brand impersonation phishing site targeting users through fraudulent Steam-related services. It posed as the legitimate platform 'blast' to deceive victims into engaging with a fake trading bot for CS:GO and CS2 skins, a tactic classified as 'steam_phish'. As of the latest verification, cs.money-stats.com has been taken offline, though its prior activity remains a concern for potential victims.

Technical analysis of cs.money-stats.com revealed minimal detection at the time of investigation. The domain showed 0 of 95 VirusTotal vendors flagging it as malicious, and Google Safe Browsing did not list it as a threat. However, it appeared on 1 security blocklist (PhishDestroy). The domain was registered through ARIN, though its creation date is not available. It resolved to the IP address 104.20.18.108, hosted by Cloudflare, Inc. (AS13335) in the US, with no SSL certificate issued. The observed page title was 'CS.MONEY — Trading Bot for fast CS:GO/CS2 skins trade', and Gridinsoft assigned it a trust score of 0/100.

Users who interacted with cs.money-stats.com should immediately change their Steam account passwords and enable two-factor authentication to prevent unauthorized access. Monitor account activity for signs of fraud, such as unauthorized trades or skin transfers. Report the domain to Steam support and file complaints with platforms like PhishTank or the Anti-Phishing Working Group to aid in broader takedown efforts. If financial or in-game assets were compromised, contact Steam support for potential recovery options.