topsskin[.]com

Analysis of the domain topsskin.com indicates it is actively hosting a phishing operation targeting users of the game Counter-Strike 2 (CS2). The page title, extracted on July 12, 2026, explicitly advertises the site as an 'official' platform for opening CS2 cases with instant item withdrawals, written in Russian. This aligns with known phishing tactics designed to deceive users into entering credentials or payment details under the guise of in-game rewards. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. It resolves to the IP address 104.21.39.158, which has been flagged in multiple threat intelligence sources. As of the latest data, 14 out of 95 security vendors on VirusTotal have detected the domain as malicious, and it appears on at least two security blocklists. AlienVault OTX records show the domain in 23 threat intelligence pulses, further corroborating its involvement in phishing activity. The SSL certificate is issued by Google Trust Services, a common practice among phishing sites to appear legitimate. Gridinsoft assigns the domain a trust score of 0/100, reinforcing its high-risk classification. While the exact phishing kit or backend infrastructure remains unconfirmed, the domain's active status and consistent detection across security platforms indicate it is part of an ongoing campaign. Defenders should prioritize blocking this domain at the DNS or network level. Users should be warned against interacting with any site claiming to offer CS2 case openings or instant item withdrawals, particularly those using unofficial domains or non-native language interfaces. Further monitoring of associated IP addresses and registrar activity may reveal additional linked infrastructure.