# PhishDestroy domain threat record: musadrop.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/musadrop.com/
Machine-readable companion: https://phishdestroy.io/domain/musadrop.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 12:59:17 UTC
- Last availability or vendor check: 2026-10-22 12:59:17 UTC
- Stored record updated: 2026-10-22 16:30:29 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: cs2

## Stored infrastructure

- Observed IP address: 104.21.44.85
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date (registry RDAP, musadrop.com): 2026-10-12 01:05:21 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a163b0-3835-76ca-a69c-f3d480c10f09/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/musadrop.com
- Certificate Transparency search: https://crt.sh/?q=%25.musadrop.com
- Web Archive lookup: https://web.archive.org/web/*/https://musadrop.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI assessment on 2026-10-22 classified musadrop.com as malicious because the page claims to be an official Counter‑Strike 2 case and upgrade service. The recorded page title reads “MUSOR Drop (МУСОР Дроп) - Официальный Сайт :: КС2 Кейсы и Апгрейды” and the meta description advertises opening CS2 cases with high RTP and instant Steam withdrawal. The domain was first seen by PhishDestroy on 2026-10-22, ten days after its registration on 2026-10-12.

How the scam works
Fake CS2 case sites lure players by promising high‑value skin drops, often citing inflated win rates and instant payouts. Victims are typically asked to deposit funds or provide Steam credentials to “open” cases, after which the site either never delivers the promised items or harvests the credentials for account takeover. The scheme relies on the reputation of the Counter‑Strike 2 brand to create trust, but no legitimate Valve service is involved.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported 0 malicious and 0 suspicious detections out of 92 engines. Google Safe Browsing also returned no flag on the same date. OTX listed four pulses referencing the domain as of 2026-10-22. urlscan.io captured the site on 2026-10-22; its machine‑learning engine assigned a malicious score of 91, though the overall verdict was not malicious. PhishDestroy’s internal blocklist marks the domain as malicious, and the HTTP request recorded on 2026-10-22 returned a 200 status code.

Infrastructure
The domain was registered on 2026-10-12 through NICENIC INTERNATIONAL GROUP CO., LIMITED and carries client‑delete‑prohibited and client‑transfer‑prohibited status. Hosting is provided by Cloudflare, with recorded A records 104.21.44.85 and 172.67.198.23 and corresponding IPv6 addresses. TLS is supplied by a Let’s Encrypt certificate valid from 2026-10-12 to 2027-01-10. The CDN’s reported location is Toronto, Canada.

What to do
Users should avoid entering Steam credentials or making any payments on musadrop.com; if credentials were entered, change the Steam password and enable Steam Guard. Defenders should block musadrop.com at the network perimeter, monitor DNS and HTTP logs for connections to the recorded Cloudflare IPs, and add the domain to internal blocklists. Reporting the abuse to the registrar and to Valve’s security team is also recommended.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a163b0-3835-76ca-a69c-f3d480c10f09/
Cloudflare Radar report: https://radar.cloudflare.com/scan/1b4f1860-f7a7-40fa-9ab3-0fd6e03fe7a1
Stored capture screenshot: https://i.ibb.co/DHwyZ9LD/b14f789dc5b1.png
URLScan screenshot (2026-10-22T13:02:04Z): https://screenshots.phishdestroy.io/us/01a163b4-1524-7587-938c-7c296108bd58.png
URLScan capture report: https://urlscan.io/result/01a163b4-1524-7587-938c-7c296108bd58/
VirusTotal report: https://www.virustotal.com/gui/domain/musadrop.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=musadrop.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 14:08:17 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/DHwyZ9LD/b14f789dc5b1.png
  Captured: 2026-10-22 12:59:17 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a163b0-3835-76ca-a69c-f3d480c10f09.png
  Captured: 2026-10-22 12:59:17 UTC
  Source report: https://urlscan.io/result/01a163b0-3835-76ca-a69c-f3d480c10f09/
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163b4-1524-7587-938c-7c296108bd58.png
  Captured: 2026-10-22 13:02:04 UTC
  Source report: https://urlscan.io/result/01a163b4-1524-7587-938c-7c296108bd58/
  SHA-256: f939500456188bf8fad19b66399f4b8630d344b048e162dc35126b4e936bbac8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T13:03:32Z",
        "uuid": "01a163b0-3835-76ca-a69c-f3d480c10f09",
        "scanned_at": "2026-10-22T12:57:50Z",
        "final_url": "https://musadrop.com/",
        "status": 200,
        "ip": "172.67.198.23",
        "domains": [
            "numclock.info"
        ],
        "ips": [
            "172.67.202.2",
            "172.67.198.23"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "cb945debe24f4378987c38800a3aad33cd09dc220aa4932e5dadc8d0cf585305",
        "script_hashes": [
            "2c604c2dba1e2f6ee535cfbb251962d86667b86abda8a16e1d26beee2070edcc",
            "e285de5b0c12ca2297b153169c20e9446629ae391feb613ce7bd160c0b0f4e31"
        ],
        "globals": [
            "mllp_0x239c",
            "mllp_0x5eb1",
            "toggleA",
            "closeModal",
            "openModal",
            "goToLogin",
            "randomizeOnline",
            "LOGIN_LINK",
            "modal",
            "closeBtn",
            "actions"
        ],
        "cookies": [
            "uv"
        ],
        "storage_keys": [
            "uv"
        ],
        "tls": {
            "san": [
                "*.musadrop.com",
                "musadrop.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "musadrop.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-10T00:10:35Z",
            "valid_from": "2026-10-12T00:10:36Z"
        },
        "domain_age_days": 10,
        "apex_age_days": 10,
        "tls_age_days": 10,
        "tls_valid_days": 89,
        "requests": 135,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 91,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T14:07:31Z",
        "uuid": "1b4f1860-f7a7-40fa-9ab3-0fd6e03fe7a1",
        "scanned_at": "2026-10-22T13:31:12Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T14:02:42Z",
        "analysis_at": "2026-10-22T13:25:21Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-12T01:05:21Z",
        "expires": "2027-10-12T01:05:21Z",
        "updated": "2026-10-12T01:05:21Z",
        "first_seen": "2026-10-12T02:43:08Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:2c55"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.198.23"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "colette.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "aiden.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:c617"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.44.85"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "aiden.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-22T13:30:42Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.musadrop.com",
                "musadrop.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "63e85ee322da821040e246c33fb7e47a9bf",
            "sha256": "a7b3f1cb9770356a1ce910b4278bde664e1760a2339fb21cba41ffb64f5acc04",
            "subject": "musadrop.com",
            "valid_to": "2027-01-10T00:10:35Z",
            "valid_from": "2026-10-12T00:10:36Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-12T01:05:21Z",
            "updated": "2026-10-12T01:05:21Z",
            "expires": "2027-10-12T01:05:21Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "aiden.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-12T01:05:21Z",
                "registration": "2026-10-12T01:05:21Z",
                "registrar expiration": "2027-10-12T01:05:21Z",
                "last update of RDAP database": "2026-10-12T01:05:21Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:33:14Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "musadrop.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-22T13:05:11Z",
            "first": "2026-10-12T05:59:48Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.1,
            "avg_page_bytes": 51887
        },
        "social_tags": {
            "title": "MUSOR Drop (МУСОР Дроп) - Официальный Сайт :: КС2 Кейсы и Апгрейды",
            "robots": "index, follow",
            "ogTitle": "Musor Drop",
            "keywords": "кейсы cs2, открыть кейс cs2, кейсы кс2, кейсы кс го, скины cs2, апгрейд скинов cs2, контракты cs2, дроп cs2, честные кейсы, musor drop, мусор дроп",
            "description": "Открывай кейсы CS2 на MUSOR DROP: высокие выигрыши, RTP 98% и самые честные шансы на дорогие скины. Апгрейды, контракты, мгновенный вывод в Steam.",
            "twitterCard": "summary",
            "ogDescription": "Открывай кейсы CS2 на MUSOR DROP: высокие выигрыши, RTP 98% и самые честные шансы на дорогие скины. Апгрейды, контракты, мгновенный вывод в Steam."
        },
        "trackers": {
            "requests": 122
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 9,
                "tls": 22,
                "wait": 185,
                "connect": 6,
                "download": 41
            },
            "response_ms": 263
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 1062236,
            "co2_grams": 0.0389,
            "cleaner_than": 1
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.38.28",
                    "host": "colette.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.55",
                    "host": "aiden.ns.cloudflare.com"
                }
            ],
            "zone": "musadrop.com"
        },
        "location": {
            "ip": "2606:4700:3033::ac43:c617",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "musadrop.com"
        },
        "dns": {
            "A": [
                "172.67.198.23",
                "104.21.44.85"
            ],
            "NS": [
                "aiden.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"aiden.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417270883, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3033::ac43:c617",
                "2606:4700:3037::6815:2c55"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3033::ac43:c617",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://musadrop.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://musor2.win/containers",
                "https://musor2.win/upgrader",
                "https://musor2.win/",
                "https://musor2.win/bonuses",
                "https://musor2.win/contracts",
                "https://musor2.win/containers/92",
                "https://musor2.win/containers/93",
                "https://musor2.win/containers/89",
                "https://musor2.win/containers/91",
                "https://musor2.win/containers/90",
                "https://musor2.win/containers/2",
                "https://musor2.win/containers/85",
                "https://musor2.win/containers/3",
                "https://musor2.win/containers/4",
                "https://musor2.win/containers/5",
                "https://musor2.win/containers/6",
                "https://musor2.win/containers/106",
                "https://musor2.win/containers/7",
                "https://musor2.win/containers/8",
                "https://musor2.win/containers/9",
                "https://musor2.win/containers/10",
                "https://musor2.win/containers/11",
                "https://musor2.win/containers/12",
                "https://musor2.win/containers/13",
                "https://musor2.win/containers/14"
            ],
            "external_count": 102
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-12T01:05:21Z",
            "updated": "2026-10-12T01:05:21Z",
            "expires": "2027-10-12T01:05:21Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "aiden.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```