# PhishDestroy domain threat record: muordrop.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/muordrop.com/
Machine-readable companion: https://phishdestroy.io/domain/muordrop.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 14:33:02 UTC
- Last availability or vendor check: 2026-10-22 14:33:02 UTC
- Stored record updated: 2026-10-22 18:30:23 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: cs2

## Stored infrastructure

- Observed IP address: 104.21.6.149
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date (registry RDAP, muordrop.com): 2026-10-12 00:33:14 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16406-33ec-71a3-a2ea-f418bed8ca2a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/muordrop.com
- Certificate Transparency search: https://crt.sh/?q=%25.muordrop.com
- Web Archive lookup: https://web.archive.org/web/*/https://muordrop.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s prior assessment described the site as an independent CS2 case‑opening platform, not impersonating a known brand. The recorded page title reads “MUSOR Drop (МУСОР ДРОП) - Официальный Сайт :: КС2 Кейсы и Апгрейды”. The domain was first seen by PhishDestroy on 2026-10-22 and returned an HTTP 200 response at that time.

How the scam works
Web pages that market CS2 case opening often try to lure users into providing Steam credentials or payment details, but no such behavior was captured on this page. The current listing therefore does not confirm any specific fraud mechanism.

Evidence
VirusTotal scanned the domain on 2026-10-22 with 92 engines and reported zero malicious and zero suspicious detections. Google Safe Browsing checked on 2026-10-22 and did not flag the site. OTX listed three pulses referencing muordrop.com as of 2026-10-22; pulses are mentions, not detections. urlscan.io captured the site on 2026-10-22; its machine‑learning engine gave a malicious score of 90 but the overall verdict was clean. No external blocklists reported the domain, while PhishDestroy’s internal list marks it as suspicious.

Infrastructure
The domain was registered on 2026-10-12 through NICENIC INTERNATIONAL GROUP CO., LIMITED, making it eight days old at the time of capture. Hosting is provided via Cloudflare with recorded A records 104.21.6.149 and 172.67.134.231, both associated with Canada. The site presented a Let's Encrypt TLS certificate for *.muordrop.com valid until 2027-01-09.

What to do
Visiting the site does not prove compromise, but users should avoid entering Steam credentials, payment information, or personal data. If any credentials were submitted, change the associated passwords and review account activity. Defenders can block muordrop.com at DNS or proxy level and monitor logs for traffic to the recorded IP addresses.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16406-33ec-71a3-a2ea-f418bed8ca2a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/b479d55e-10ae-4e56-b059-4cc674416caf
Stored capture screenshot: https://i.ibb.co/tMJST4H1/4a04b18e1cc7.png
URLScan screenshot (2026-10-22T14:21:06Z): https://screenshots.phishdestroy.io/us/01a163fc-75c0-7605-a1a1-341c249ce88d.png
URLScan capture report: https://urlscan.io/result/01a163fc-75c0-7605-a1a1-341c249ce88d/
URLScan screenshot (2026-10-22T14:25:58Z): https://screenshots.phishdestroy.io/us/01a16400-e4a1-705d-b014-a6437f5786fa.png
URLScan capture report: https://urlscan.io/result/01a16400-e4a1-705d-b014-a6437f5786fa/
URLScan screenshot (2026-10-22T14:26:37Z): https://screenshots.phishdestroy.io/us/01a16401-65c8-72a1-b403-cfbffa574315.png
URLScan capture report: https://urlscan.io/result/01a16401-65c8-72a1-b403-cfbffa574315/
VirusTotal report: https://www.virustotal.com/gui/domain/muordrop.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=muordrop.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 15:05:34 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/tMJST4H1/4a04b18e1cc7.png
  Captured: 2026-10-22 14:33:02 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16406-33ec-71a3-a2ea-f418bed8ca2a.png
  Captured: 2026-10-22 14:33:02 UTC
  Source report: https://urlscan.io/result/01a16406-33ec-71a3-a2ea-f418bed8ca2a/
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163fc-75c0-7605-a1a1-341c249ce88d.png
  Captured: 2026-10-22 14:21:06 UTC
  Source report: https://urlscan.io/result/01a163fc-75c0-7605-a1a1-341c249ce88d/
  SHA-256: f939500456188bf8fad19b66399f4b8630d344b048e162dc35126b4e936bbac8
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16400-e4a1-705d-b014-a6437f5786fa.png
  Captured: 2026-10-22 14:25:58 UTC
  Source report: https://urlscan.io/result/01a16400-e4a1-705d-b014-a6437f5786fa/
  SHA-256: f939500456188bf8fad19b66399f4b8630d344b048e162dc35126b4e936bbac8
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16401-65c8-72a1-b403-cfbffa574315.png
  Captured: 2026-10-22 14:26:37 UTC
  Source report: https://urlscan.io/result/01a16401-65c8-72a1-b403-cfbffa574315/
  SHA-256: f939500456188bf8fad19b66399f4b8630d344b048e162dc35126b4e936bbac8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T15:04:31Z",
        "uuid": "01a16406-33ec-71a3-a2ea-f418bed8ca2a",
        "scanned_at": "2026-10-22T14:31:51Z",
        "final_url": "https://muordrop.com/",
        "status": 200,
        "ip": "172.67.134.231",
        "domains": [
            "numclock.info"
        ],
        "ips": [
            "172.67.202.2",
            "172.67.134.231"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "cb945debe24f4378987c38800a3aad33cd09dc220aa4932e5dadc8d0cf585305",
        "script_hashes": [
            "2c604c2dba1e2f6ee535cfbb251962d86667b86abda8a16e1d26beee2070edcc",
            "e285de5b0c12ca2297b153169c20e9446629ae391feb613ce7bd160c0b0f4e31"
        ],
        "globals": [
            "mllp_0x239c",
            "mllp_0x5eb1",
            "toggleA",
            "closeModal",
            "openModal",
            "goToLogin",
            "randomizeOnline",
            "LOGIN_LINK",
            "modal",
            "closeBtn",
            "actions"
        ],
        "cookies": [
            "uv"
        ],
        "storage_keys": [
            "uv"
        ],
        "tls": {
            "san": [
                "*.muordrop.com",
                "muordrop.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "muordrop.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-09T23:37:12Z",
            "valid_from": "2026-10-11T23:37:13Z"
        },
        "domain_age_days": 8,
        "apex_age_days": 8,
        "tls_age_days": 10,
        "tls_valid_days": 89,
        "requests": 136,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 90,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T16:09:33Z",
        "uuid": "b479d55e-10ae-4e56-b059-4cc674416caf",
        "scanned_at": "2026-10-22T15:03:47Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T15:03:42Z",
        "analysis_at": "2026-10-22T13:37:34Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-12T00:33:15Z",
        "expires": "2027-10-12T00:33:14Z",
        "updated": "2026-10-12T00:33:15Z",
        "first_seen": "2026-10-12T06:26:50Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "aiden.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:86e7"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:695"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "aiden.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.134.231"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.6.149"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "colette.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-22T13:50:11Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.muordrop.com",
                "muordrop.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "526cc9bd352677cdbe2a71bfb983338e984",
            "sha256": "1231747f7b5321216f36580f7adf45b0cf909ef43e7cd7b8514c9c9813abd38e",
            "subject": "muordrop.com",
            "valid_to": "2027-01-09T23:37:12Z",
            "valid_from": "2026-10-11T23:37:13Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-12T00:33:14Z",
            "updated": "2026-10-12T00:33:15Z",
            "expires": "2027-10-12T00:33:14Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "aiden.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-12T00:33:14Z",
                "registration": "2026-10-12T00:33:15Z",
                "registrar expiration": "2027-10-12T00:33:14Z",
                "last update of RDAP database": "2026-10-12T00:33:15Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T15:05:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "muordrop.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-22T14:34:24Z",
            "first": "2026-10-12T03:34:20Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.1,
            "avg_page_bytes": 51876
        },
        "social_tags": {
            "title": "MUSOR Drop (МУСОР Дроп) - Официальный Сайт :: КС2 Кейсы и Апгрейды",
            "robots": "index, follow",
            "ogTitle": "Musor Drop",
            "keywords": "кейсы cs2, открыть кейс cs2, кейсы кс2, кейсы кс го, скины cs2, апгрейд скинов cs2, контракты cs2, дроп cs2, честные кейсы, musor drop, мусор дроп",
            "description": "Открывай кейсы CS2 на MUSOR DROP: высокие выигрыши, RTP 98% и самые честные шансы на дорогие скины. Апгрейды, контракты, мгновенный вывод в Steam.",
            "twitterCard": "summary",
            "ogDescription": "Открывай кейсы CS2 на MUSOR DROP: высокие выигрыши, RTP 98% и самые честные шансы на дорогие скины. Апгрейды, контракты, мгновенный вывод в Steam."
        },
        "trackers": {
            "requests": 122
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 38,
                "wait": 313,
                "connect": 6,
                "download": 149
            },
            "response_ms": 508
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 1062236,
            "co2_grams": 0.0389,
            "cleaner_than": 1
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.38.28",
                    "host": "colette.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.193.55",
                    "host": "aiden.ns.cloudflare.com"
                }
            ],
            "zone": "muordrop.com"
        },
        "location": {
            "ip": "2606:4700:3035::6815:695",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "muordrop.com"
        },
        "dns": {
            "A": [
                "172.67.134.231",
                "104.21.6.149"
            ],
            "NS": [
                "aiden.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"aiden.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417268988, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3031::ac43:86e7",
                "2606:4700:3035::6815:695"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3031::ac43:86e7",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://muordrop.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://musor2.win/containers",
                "https://musor2.win/upgrader",
                "https://musor2.win/",
                "https://musor2.win/bonuses",
                "https://musor2.win/contracts",
                "https://musor2.win/containers/92",
                "https://musor2.win/containers/93",
                "https://musor2.win/containers/89",
                "https://musor2.win/containers/91",
                "https://musor2.win/containers/90",
                "https://musor2.win/containers/2",
                "https://musor2.win/containers/85",
                "https://musor2.win/containers/3",
                "https://musor2.win/containers/4",
                "https://musor2.win/containers/5",
                "https://musor2.win/containers/6",
                "https://musor2.win/containers/106",
                "https://musor2.win/containers/7",
                "https://musor2.win/containers/8",
                "https://musor2.win/containers/9",
                "https://musor2.win/containers/10",
                "https://musor2.win/containers/11",
                "https://musor2.win/containers/12",
                "https://musor2.win/containers/13",
                "https://musor2.win/containers/14"
            ],
            "external_count": 102
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-12T00:33:14Z",
            "updated": "2026-10-12T00:33:15Z",
            "expires": "2027-10-12T00:33:14Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "aiden.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```