skinport-deal[.]com

Analysis of the domain skinport-deal.com indicates active phishing infrastructure targeting users of the CS2 (Counter-Strike 2) skins marketplace. The domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu and currently resolves to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). The page title, 'Skinport CS2 - Best CS2 Skins Marketplace | Instant Trade,' explicitly references Skinport, a legitimate skins trading platform, suggesting an intent to deceive users into believing the site is an official or affiliated marketplace. The domain employs Cloudflare nameservers (fay.ns.cloudflare.com, norm.ns.cloudflare.com) and presents a valid SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to visitors. Infrastructure checks reveal the domain is flagged by 2 of 93 security vendors on VirusTotal, though this detection rate alone does not confirm malicious activity without further context.

It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating prior identification as a phishing threat. The domain's Gridinsoft trust score of 0/100 further supports its classification as high-risk. An HTTP 301 redirect is present, though the destination remains unconfirmed; such redirects are commonly used in phishing campaigns to obscure the final malicious payload or credential-harvesting page. Defenders should treat this domain as an active phishing threat targeting CS2 skin traders.

The combination of a recently registered domain, Cloudflare hosting, and explicit branding mimicry aligns with known phishing tactics. Network-level blocking is recommended, particularly for organizations with users engaged in gaming or digital asset trading. Further investigation into the redirect chain and associated infrastructure may reveal additional compromised or attacker-controlled domains.