mycsgoo[.]shop

This domain, mycsgoo.shop, is flagged as an active brand impersonation scam targeting users of the mycsgo platform, a site associated with CS2 (Counter-Strike 2) skin trading and case openings. Analysis indicates the domain is hosted behind Cloudflare (AS13335) on IP 172.67.133.184, a common infrastructure choice for phishing operations due to its ease of deployment and obfuscation capabilities. The page title explicitly references mycsgo, CS2 skins, cases, reviews, and promotional codes, suggesting an attempt to lure victims by mimicking legitimate gaming skin marketplaces. The domain is registered through Global Domain Group LLC, a registrar frequently observed in fraudulent registrations, and uses Cloudflare nameservers (guss.ns.cloudflare.com, luciana.ns.cloudflare.com). Security vendors have detected the domain, with 9 out of 91 flagging it as malicious, though the specific nature of the payload or redirection chain remains unconfirmed. The domain appears on at least one security blocklist and has been documented in a threat intelligence pulse, indicating prior awareness of its malicious activity. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate compromise but is consistent with the domain's recent registration and Cloudflare deployment. Defenders should treat this domain as high-risk due to its active status, brand impersonation tactics, and confirmed malicious detections. Immediate actions include blocking the domain and its resolving IP at the network level, monitoring for internal access attempts, and alerting users to the presence of this scam, particularly those engaged in gaming or skin trading communities. Further analysis of the site's content and backend infrastructure is recommended to identify additional indicators of compromise, such as payment redirection endpoints or credential harvesting scripts.