skinsmonkey[.]co[.]com

The domain skinsmonkey.co.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Counter‑Strike franchise. Infrastructure analysis shows the domain resolves to IP 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The domain was created on 16 August 1997 and is registered through Moniker Online Services LLC. Its authoritative nameservers are ns1.nic.co.com, ns2.nic.co.com, ns3.nic.co.com, and ns4.nic.co.com. The site presents an HTTP 302 redirect and serves a TLS certificate issued by Let’s Encrypt (R12). The observed page title is "Skinsmonkey | CS2 Skins Trading Marketplace 2025," and the web server is identified as Nginx. Reputation data indicates the domain is listed on five public blocklists and has been blocked by services such as PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. VirusTotal scans report 15 of 95 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 / 100. While the visible content has not been examined, the combination of a brand‑specific title, redirection behavior, and multiple security detections strongly suggests a malicious operation designed to lure Counter‑Strike players. Defenders should block the domain at DNS and firewall layers, monitor for outbound connections to the associated IP, and update endpoint detection rules to include the observed TLS fingerprint and Nginx banner. Continuous monitoring of the listed blocklists is recommended to capture any further activity related to this infrastructure.