liss-sskins[.]com

This domain, liss-sskins.com, is flagged as a generic phishing site targeting users of Counter-Strike 2 (CS2) and DotA2 gaming communities. Analysis indicates the site impersonates a legitimate skins trading platform, likely designed to harvest user credentials, payment details, or deploy malicious payloads under the guise of in-game item transactions. The page title, 'LIS-SKINS — Продать Скины CS2 и DotA2 | Официальный Сайт,' explicitly claims official status, a common tactic to establish false trust with potential victims. No evidence of a known drainer kit was identified, but the infrastructure aligns with credential-phishing campaigns targeting gaming assets. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain resolves to IP address 58.64.137.69, hosted on AS17444 (HKBN Enterprise Solutions Limited) in Hong Kong, a region frequently associated with high-risk hosting providers. Registered through NiceNIC International Group Co., Limited on March 05, 2026, the domain exhibits an anomalous creation date, suggesting potential WHOIS manipulation or a typo-squatting variant. VirusTotal detection rates show 17 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. Notably, the domain lacks SSL encryption, a critical red flag for any site handling user data or financial transactions. No Google Safe Browsing (GSB) listing was observed at the time of analysis, though this may reflect a lag in propagation rather than benign status. Current status indicates the domain has been taken offline, likely in response to security vendor detections or hosting provider intervention. However, residual risk persists due to the domain's recent activity and the potential for threat actors to migrate infrastructure to new hosts or domains. Users who interacted with the site should assume credential compromise and initiate password resets, particularly for gaming accounts or linked payment methods. Organizations monitoring for phishing campaigns should correlate this domain with other indicators, such as the IP address 58.64.137.69 and registrar NiceNIC, to identify related threats. Proactive measures include blocking the domain and IP at network perimeters, as well as educating users on verifying SSL certificates and official branding before engaging with gaming-related commerce sites.