# PhishDestroy domain threat record: musodrop.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/musodrop.com/
Machine-readable companion: https://phishdestroy.io/domain/musodrop.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 14:50:38 UTC
- Last availability or vendor check: 2026-10-25 14:54:29 UTC
- Stored record updated: 2026-10-25 15:30:32 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: cs2

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-03 16:35:50 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1738c-7730-725c-84d9-213384de2729/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/musodrop.com
- Certificate Transparency search: https://crt.sh/?q=%25.musodrop.com
- Web Archive lookup: https://web.archive.org/web/*/https://musodrop.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added musodrop.com to its internal blocklist on 2026-10-25 after an automated URLScan scan returned a malicious verdict. The recorded page title advertises a CS2 case‑opening service called MUSOR Drop. An HTTP 200 response was observed on 2026-10-25, while a later URLScan capture of a sub‑path returned HTTP 403.

How the scam works
The URLScan engine classified the site as phishing, a technique where attackers host pages that mimic legitimate services to lure users into disclosing credentials or payment information. Because no phishing form or wallet request was captured, the exact method used by this page cannot be confirmed.

Evidence
URLScan captured on 2026-10-16 assigned a malicious score of 100 and labeled the domain as phishing. VirusTotal analysis on 2026-10-15 reported three detections out of 92 engines (alphaMountain.ai suspicious, CRDF malicious, Fortinet spam). Google Safe Browsing checked on 2026-10-25 reported no flag, PhishDestroy’s internal list marked the domain as blocked, OTX showed zero pulses, and external blocklist checks on the same date found no matches.

Infrastructure
The domain was registered on 2026-09-03 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS records observed on 2026-10-25 resolve to Cloudflare IP addresses (e.g., 188.114.97.1) and the zone uses indie.ns.cloudflare.com and rodrigo.ns.cloudflare.com as nameservers; DNSSEC is not enabled. The TLS certificate, issued by Let’s Encrypt, is valid from 2026-09-20 to 2026-12-19 for musodrop.com and *.musodrop.com.

What to do
Visitors should avoid entering any credentials, payment details, or personal information on musodrop.com and monitor any accounts that may have been used there. Defenders can block the exact domain musodrop.com at the network perimeter and log DNS queries for this name.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a141f7-3529-7344-aea9-6b8c22297722/
Cloudflare Radar report: https://radar.cloudflare.com/scan/47598578-7fe5-4937-81b3-ebd9d3870252
Stored capture screenshot: https://urlscan.io/screenshots/01a141f7-3529-7344-aea9-6b8c22297722.png
Cloudflare Radar screenshot (2026-10-25T14:51:25Z): https://screenshots.phishdestroy.io/cf/47598578-7fe5-4937-81b3-ebd9d3870252.png
URLScan screenshot (2026-09-20T09:26:03Z): https://screenshots.phishdestroy.io/us/01a0be22-d2a9-7117-bbd4-e7b93e75c423.png
URLScan capture report: https://urlscan.io/result/01a0be22-d2a9-7117-bbd4-e7b93e75c423/
URLScan screenshot (2026-10-02T16:28:16Z): https://screenshots.phishdestroy.io/us/01a0fd71-d3af-7376-91da-dfbf1efdd258.png
URLScan capture report: https://urlscan.io/result/01a0fd71-d3af-7376-91da-dfbf1efdd258/
URLScan screenshot (2026-10-02T20:57:01Z): https://screenshots.phishdestroy.io/us/01a0fe67-dd5f-75f9-9ad9-e1e283967aba.png
URLScan capture report: https://urlscan.io/result/01a0fe67-dd5f-75f9-9ad9-e1e283967aba/
VirusTotal report: https://www.virustotal.com/gui/domain/musodrop.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=musodrop.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 14:52:45 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1738c-7730-725c-84d9-213384de2729.png
  Captured: 2026-10-25 14:54:29 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a141f7-3529-7344-aea9-6b8c22297722.png
  Captured: 2026-10-25 14:50:38 UTC
  Source report: https://urlscan.io/result/01a1738c-7730-725c-84d9-213384de2729/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/47598578-7fe5-4937-81b3-ebd9d3870252.png
  Captured: 2026-10-25 14:51:25 UTC
  Source report: https://radar.cloudflare.com/scan/47598578-7fe5-4937-81b3-ebd9d3870252
  SHA-256: 21a58198717fa31c8c243ab0cb1443139955def6590ef668f886c840209fbb39
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0be22-d2a9-7117-bbd4-e7b93e75c423.png
  Captured: 2026-09-20 09:26:03 UTC
  Source report: https://urlscan.io/result/01a0be22-d2a9-7117-bbd4-e7b93e75c423/
  SHA-256: f939500456188bf8fad19b66399f4b8630d344b048e162dc35126b4e936bbac8
- URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fd71-d3af-7376-91da-dfbf1efdd258.png
  Captured: 2026-10-02 16:28:16 UTC
  Source report: https://urlscan.io/result/01a0fd71-d3af-7376-91da-dfbf1efdd258/
  SHA-256: 6f821fa9c4d22a421a8eb475af432fbec2fd301c6f8a2d8e123f314a0514da3a
- URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fe67-dd5f-75f9-9ad9-e1e283967aba.png
  Captured: 2026-10-02 20:57:01 UTC
  Source report: https://urlscan.io/result/01a0fe67-dd5f-75f9-9ad9-e1e283967aba/
  SHA-256: 0bfdbfbcac8107448457c7981c1bbee8a9c03985058a53a7c7ded481fe805665

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T15:11:11Z",
        "uuid": "01a1738c-7730-725c-84d9-213384de2729",
        "scanned_at": "2026-10-25T14:52:41Z",
        "final_url": "https://musodrop.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://musodrop.com/",
                "from": "http://musodrop.com/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "ips": [
            "188.114.96.3"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "fd3c35e2b3c62ca6cb88543d04c7a551ce2f240800d3aae1a6f04cc0bb3f1e57",
        "script_hashes": [
            "6d8d5b4550d90309703698769fde4aaeb24f072083d6438f6d66fbf584273930"
        ],
        "globals": [
            "closeModal",
            "openModal",
            "goToLogin",
            "randomizeOnline",
            "LOGIN_LINK",
            "modal",
            "closeBtn",
            "actions"
        ],
        "tls": {
            "san": [
                "*.musodrop.com",
                "musodrop.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "musodrop.com",
            "protocol": "QUIC",
            "valid_to": "2026-12-19T14:30:37Z",
            "valid_from": "2026-09-20T14:30:38Z"
        },
        "domain_age_days": 1916,
        "apex_age_days": 1916,
        "tls_age_days": 35,
        "tls_valid_days": 89,
        "requests": 137,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 36,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T14:51:59Z",
        "uuid": "47598578-7fe5-4937-81b3-ebd9d3870252",
        "scanned_at": "2026-10-25T14:51:25Z",
        "final_url": "https://musodrop.com/",
        "status": 200,
        "history": [
            {
                "url": "https://musodrop.com/",
                "status": 200
            }
        ],
        "dom_hash": "26cf1732a57423f8455e81f7289f883f5117d2b3913935aedd7942c87e926d70",
        "doc_hash": "02712d4e3b2a6dcb33a9d6a6364ec0d86588702368fa7ab73cc5b801cff367ea",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Entertainment",
            "Music"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "musodrop.com",
                "type": "A",
                "value": "172.67.172.148"
            },
            {
                "name": "musodrop.com",
                "type": "A",
                "value": "104.21.80.13"
            },
            {
                "name": "musodrop.com",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:ac94"
            },
            {
                "name": "musodrop.com",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:500d"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.172.148",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-09-03T18:35:50Z",
            "updated": "2026-10-24T02:18:45Z",
            "expires": "2027-09-03T18:35:50Z",
            "nameservers": [
                "indie.ns.cloudflare.com",
                "rodrigo.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T14:51:00Z",
        "analysis_at": "2026-10-15T14:34:43Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 1,
            "suspicious": 2,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "Fortinet": "spam",
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Suspicious, Newly Registered (alphaMountain.ai)"
        },
        "popularity": {
            "Alexa": 363383,
            "Statvoo": 363333
        },
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-09-03T18:35:50Z",
        "expires": "2027-09-03T18:35:50Z",
        "updated": "2026-10-06T00:13:52Z",
        "first_seen": "2026-09-05T23:29:10Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "indie.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.80.13"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:ac94"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "rodrigo.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.172.148"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:500d"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "indie.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-15T14:34:59Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.musodrop.com",
                "musodrop.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "681ebfe1f35fa3e5464c03485fe4a7dd526",
            "sha256": "a16b9e51f1480a263dcecc39f3521642d301fa72b36b3536e3660ec6ee301e60",
            "subject": "musodrop.com",
            "valid_to": "2026-12-19T14:30:37Z",
            "valid_from": "2026-09-20T14:30:38Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-09-03T18:35:50Z",
            "updated": "2026-09-03T18:35:50Z",
            "expires": "2027-09-03T18:35:50Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "indie.ns.cloudflare.com",
                "rodrigo.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-03T18:35:50Z",
                "registration": "2026-09-03T18:35:50Z",
                "registrar expiration": "2027-09-03T18:35:50Z",
                "last update of RDAP database": "2026-09-03T18:35:50Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T14:52:21Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "musodrop.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T14:51:01Z",
            "first": "2021-09-03T15:45:12Z",
            "changes": 4,
            "days_archived": 5,
            "scans_per_day": 0,
            "avg_page_bytes": 29535
        },
        "social_tags": {
            "title": "MUSOR Drop (МУСОР Дроп) - Официальный Сайт :: КС2 Кейсы и Апгрейды",
            "robots": "index, follow",
            "ogTitle": "Musor Drop",
            "keywords": "кейсы cs2, открыть кейс cs2, кейсы кс2, кейсы кс го, скины cs2, апгрейд скинов cs2, контракты cs2, дроп cs2, честные кейсы, musor drop, мусор дроп",
            "description": "Открывай кейсы CS2 на MUSOR DROP: высокие выигрыши, RTP 98% и самые честные шансы на дорогие скины. Апгрейды, контракты, мгновенный вывод в Steam.",
            "twitterCard": "summary",
            "ogDescription": "Открывай кейсы CS2 на MUSOR DROP: высокие выигрыши, RTP 98% и самые честные шансы на дорогие скины. Апгрейды, контракты, мгновенный вывод в Steam."
        },
        "trackers": {
            "requests": 120
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 21,
                "tls": 30,
                "wait": 535,
                "connect": 34,
                "download": 32
            },
            "response_ms": 652
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 1062190,
            "co2_grams": 0.0389,
            "cleaner_than": 1
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.163",
                    "host": "indie.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.44.78",
                    "host": "rodrigo.ns.cloudflare.com"
                }
            ],
            "zone": "musodrop.com"
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "musodrop.com"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "rodrigo.ns.cloudflare.com",
                "indie.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"indie.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416786274, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://musodrop.com"
            ]
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.musodrop.com"
            ]
        },
        "linked_pages": {
            "external": [
                "https://musor2.win/containers",
                "https://musor2.win/upgrader",
                "https://musor2.win/",
                "https://musor2.win/bonuses",
                "https://musor2.win/contracts",
                "https://musor2.win/containers/92",
                "https://musor2.win/containers/93",
                "https://musor2.win/containers/89",
                "https://musor2.win/containers/91",
                "https://musor2.win/containers/90",
                "https://musor2.win/containers/2",
                "https://musor2.win/containers/85",
                "https://musor2.win/containers/3",
                "https://musor2.win/containers/4",
                "https://musor2.win/containers/5",
                "https://musor2.win/containers/6",
                "https://musor2.win/containers/106",
                "https://musor2.win/containers/7",
                "https://musor2.win/containers/8",
                "https://musor2.win/containers/9",
                "https://musor2.win/containers/10",
                "https://musor2.win/containers/11",
                "https://musor2.win/containers/12",
                "https://musor2.win/containers/13",
                "https://musor2.win/containers/14"
            ],
            "external_count": 102
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-09-03T18:35:50Z",
            "updated": "2026-10-24T02:18:45Z",
            "expires": "2027-09-03T18:35:50Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "indie.ns.cloudflare.com",
                "rodrigo.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```