Is sinport.org a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Sinport.org is a website whose homepage title presents it as the "official website" of Skinport, a Counter-Strike 2 (CS2) skin marketplace where visitors can trade and buy in-game skins "securely". Its apparent purpose is a peer-to-peer marketplace for virtual items, where visitors would be asked to authenticate and transact. The domain name is spelled differently from the brand it invokes.

Scam/Impersonation Risk

Contradictory signals are present and decisive. The domain is blacklisted by external threat-intelligence sources, and several leading security vendors independently classify it as malicious. The homepage title claims official status for a well-known skin-trading brand, but the domain is a near-variant spelling of that brand's name. This is the standard lookalike pattern used to harvest marketplace logins, trading credentials, and payment details. The site's content could not be deeply analysed, so the specific mechanism of abuse (credential capture, malicious downloads, or fraudulent trades) is not established. The independent detections alone justify a cautionary posture. The domain's history reinforces this. Its archive shows two early captures in 2004 and nothing again until 2026. Its current registration is only a few months old, so the present site is effectively a new deployment. A CS2 skin marketplace is a high-value target because accounts and inventories are easily monetised. Evidence:

• Homepage: the page title claims to be the official website of a CS2 skin market, while the domain name is a misspelled variant of that brand.
• Reputation: multiple major security vendors flag the domain as malicious, and an external blacklist listing is active.
• Domain provenance: registered on 2026-07-20 (~0.27 years old). The archive holds 6 snapshots spanning 2004–2026 (23 years tracked), with three captures in 2004 and three in 2026 and nothing between.

Regulatory Verification Notes

No licensing, registration, or legal-entity disclosure could be confirmed for this site, and the on-page disclosure position remains unclear. For a marketplace handling payments and tradable digital assets, this is a verification gap in its own right. It is not treated as proof of fraud, since the reputational detections above carry that weight. No third-party broker-reputation record matched this domain, and none is relied upon. The site's transport encryption is valid, but it is a basic domain-validated certificate, and encryption confirms only that the connection is private. It says nothing about who operates the site. Evidence:

• Homepage: the page was captured successfully, but no operator identity could be independently connected to a real-world brand or person.
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-17 with about 51 days remaining.
• Hosting: served from AS13335 (CLOUDFLARENET, Cloudflare, Inc., US); the registrar is Key-Systems GmbH, with registrant details redacted for privacy.

What to Verify Next

Anyone who believes they have an account or pending trade relationship with Skinport should confirm the brand's genuine domain by typing it manually or using a previously saved bookmark. They should not use links from messages, search ads, or chat platforms. Any account activity, trade offers, or payment requests that originated from this domain should be reviewed directly in the genuine platform, and the Steam account should be checked for unexpected sessions or linked applications. If credentials, API keys, or trade links were entered here, they should be treated as exposed and rotated. The operator's claimed licensing or corporate registration should be checked with the relevant registry before any further engagement. Evidence:

• Homepage: the "official website" claim should be tested against the brand's own published channels, not against this site.
• Registration record: the domain was created in July 2026, so it cannot be a long-standing official property.
• Reputation: active vendor detections should be re-checked against current threat feeds before any decision to revisit the site.

Summary Verdict

The overall posture is high-risk. Independent threat detections and a brand-lookalike domain converge on a site that should be treated as hostile until proven otherwise. Its legitimacy is not established, and nothing in the available evidence offsets the reputational findings.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address. The origin server is not visible, so independent verification of the real hosting is not possible. Edge-only visibility can also conceal rapid content swaps behind a stable address. This protective infrastructure is a mitigating factor only. It is not evidence of legitimacy, and it cannot offset the external threat detections.

Closing Assessment

Treat the site as read-only at most, with no login, credential entry, trade-link sharing, or payment of any kind. Anyone who has already interacted with it should secure their accounts immediately, and any related message or link should be reported to the genuine platform's support channel.