# PhishDestroy domain threat record: musor.blog Content language: English Canonical HTML report: https://phishdestroy.io/domain/musor.blog/ Machine-readable companion: https://phishdestroy.io/domain/musor.blog/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 14:51:53 UTC - Last availability or vendor check: 2026-10-25 14:51:53 UTC - Stored record updated: 2026-10-25 23:23:40 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: cs2 ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Dynadot LLC - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-04 01:38:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1738a-a8f0-7278-be6b-b0b33b6d6666/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/musor.blog - Certificate Transparency search: https://crt.sh/?q=%25.musor.blog - Web Archive lookup: https://web.archive.org/web/*/https://musor.blog/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI assigned a strong phishing confidence (90%) and flagged musor.blog because the site describes a CS2 “MUSOR DROP” case‑opening and upgrade gambling service, offers a promotional code and mentions Steam login and withdrawal. The domain was first seen by PhishDestroy on 2026-10-25 and returned an HTTP 200 response at that time. The assessment relies on page metadata and AI‑generated reasoning, not on observed transactions. How the scam works Sites that market CS2 case‑opening or upgrade services typically lure users with high‑return‑to‑player claims, require a Steam login, and ask for deposits or personal credentials to “withdraw” virtual items. Because the services are unregulated, they can harvest Steam credentials, charge fees, or disappear with any funds or items the victim provides. This pattern is treated as a fraudulent gambling or phishing scheme. Evidence VirusTotal recorded two malicious detections out of 92 engines on 2026-10-25, specifically from Forcepoint ThreatSeeker and SOCRadar, labeling the domain as phishing. Google Safe Browsing reported no flag on the same date. OTX listed four pulses referencing the domain. PhishDestroy’s internal blocklist marks the domain as malicious, while external blocklists (including Spamhaus) showed no entry as of 2026-10-25. URLScan’s engine flagged the site as malicious with a score of 100, though its overall verdict was non‑malicious; the scan captured the page title and metadata on 2026-10-25. Infrastructure The domain was registered on 2026-09-04 with Dynadot LLC, giving it a 51‑day age at first sight. The recorded DNS at the time listed Cloudflare A records 172.67.168.3 and 104.21.74.93 and AAAA records in the 2606:4700:: range. The TLS certificate, issued by Google Trust Services, is valid until 2026-12-20 and covers musor.blog and its sub‑domains. No DNSSEC signatures were present, and the domain was not listed on Spamhaus or other external blocklists. What to do Users should avoid entering Steam credentials or any payment information on musor.blog and, if they have already done so, change their Steam password and enable two‑factor authentication. Organizations should block musor.blog at the DNS or proxy level, monitor outbound connections to its recorded IPs, and review logs for any Steam‑related authentication attempts. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1738a-a8f0-7278-be6b-b0b33b6d6666/ Cloudflare Radar report: https://radar.cloudflare.com/scan/c3b0eebd-df75-4a78-a44a-a0763d2bd9cc Stored capture screenshot: https://i.ibb.co/LdMqNSnB/c5706d6b86ce.png Cloudflare Radar screenshot (2026-10-25T15:25:26Z): https://screenshots.phishdestroy.io/cf/c3b0eebd-df75-4a78-a44a-a0763d2bd9cc.png URLScan screenshot (2026-10-25T15:05:36Z): https://screenshots.phishdestroy.io/us/01a17398-4e29-776b-ae36-629deec3c889.png URLScan capture report: https://urlscan.io/result/01a17398-4e29-776b-ae36-629deec3c889/ VirusTotal report: https://www.virustotal.com/gui/domain/musor.blog Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=musor.blog Archived copy: https://web.archive.org/web/20261025145215/https://musor.blog/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 16:36:25 UTC ## Stored page captures - Primary capture: https://i.ibb.co/LdMqNSnB/c5706d6b86ce.png Captured: 2026-10-25 14:51:53 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1738a-a8f0-7278-be6b-b0b33b6d6666.png Captured: 2026-10-25 14:51:53 UTC Source report: https://urlscan.io/result/01a1738a-a8f0-7278-be6b-b0b33b6d6666/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c3b0eebd-df75-4a78-a44a-a0763d2bd9cc.png Captured: 2026-10-25 15:25:26 UTC Source report: https://radar.cloudflare.com/scan/c3b0eebd-df75-4a78-a44a-a0763d2bd9cc SHA-256: 78c462d8dc06b924894f2aa38771f2380e272a029d3a6232ecb13aac4c1f704d - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17398-4e29-776b-ae36-629deec3c889.png Captured: 2026-10-25 15:05:36 UTC Source report: https://urlscan.io/result/01a17398-4e29-776b-ae36-629deec3c889/ SHA-256: 0c4389c8dd1c02678b1bebbfdd5a677f4a29892a029afed8cfde95e25f04bdb6 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T15:11:11Z", "uuid": "01a1738a-a8f0-7278-be6b-b0b33b6d6666", "scanned_at": "2026-10-25T14:50:38Z", "final_url": "https://musor.blog/", "status": 200, "ip": "188.114.96.3", "domains": [ "musorprod.web.gaypictures.online", "mc.yandex.com", "community.akamai.steamstatic.com", "musor.bar", "musor.best", "fonts.gstatic.com", "mc.yandex.ru", "fonts.googleapis.com", "musor2.win" ], "ips": [ "95.129.232.111", "23.32.239.51", "142.251.127.94", "2a02:6b8::1:119", "95.129.237.63", "186.2.163.224", "2a00:1450:4001:c0f::5f", "188.114.96.3" ], "asns": [ "57724", "20940", "15169", "13238", "59692", "13335" ], "countries": [ "RU", "DE", "US", "NL" ], "link_domains": [ "musor.click" ], "doc_hash": "d401bb094378b1793982a16a21f6ba0a0eee76d07e58b9cf142791143c2d1b8c", "script_hashes": [ "daf818f12f80d05284a1e7ad3488249e07f0b3594f7afcaa701a9a35daa34dbd" ], "globals": [ "ym", "Ya", "yaCounter112281526", "dataLayer", "REF", "SKINS", "track", "online", "CATALOG", "catalog" ], "cookies": [ "bh", "_ym_uid", "_ym_d", "sync_cookie_csrf", "_ym_isad", "yabs-sid", "i", "yandexuid", "yuidss", "ymex", "sync_cookie_csrf_secondary", "sync_cookie_ok_secondary" ], "storage_keys": [ "_ymBRC", "_ym_synced", "_ym112281526_lsid", "_ym112281526:0_reqNum", "_ym_uid", "_ym_retryReqs", "_ym_jn" ], "tls": { "san": [ "musor.blog", "musor26.musor.blog", "*.musor26.musor.blog" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "musor.blog", "protocol": "QUIC", "valid_to": "2026-12-20T01:48:01Z", "valid_from": "2026-09-21T00:48:04Z" }, "domain_age_days": 51, "apex_age_days": 51, "tls_age_days": 34, "tls_valid_days": 90, "requests": 73, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T15:27:40Z", "uuid": "c3b0eebd-df75-4a78-a44a-a0763d2bd9cc", "scanned_at": "2026-10-25T15:25:26Z", "final_url": "https://musor.blog/", "status": 200, "history": [ { "url": "https://musor.blog/", "status": 200 } ], "dom_hash": "0e1a14ad173216847ffd35809c71c10514fcd6220ce6a0f579bdf45fa66b02e9", "doc_hash": "3e614dbe7ff9fa2d46340f756b30f9107a1ab7f08260c296b689e1efe24c4747", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "musor.blog", "type": "A", "value": "172.67.168.3" }, { "name": "musor.blog", "type": "A", "value": "104.21.74.93" }, { "name": "musor.blog", "type": "AAAA", "value": "2606:4700:3037::ac43:a803" }, { "name": "musor.blog", "type": "AAAA", "value": "2606:4700:3034::6815:4a5d" } ], "dnssec_valid": false, "ip": "172.67.168.3", "whois": { "registrar": "Dynadot LLC", "created": "2026-09-04T03:38:58Z", "updated": "2026-09-09T03:42:55Z", "expires": "2027-09-04T03:38:58Z", "nameservers": [ "henrik.ns.cloudflare.com", "ruth.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T16:34:25Z", "analysis_at": "2026-10-25T15:22:29Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 2, "suspicious": 0, "undetected": 37 }, "detections": { "SOCRadar": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Dynadot LLC", "created": "2026-09-04T03:38:58Z", "expires": "2027-09-04T03:38:58Z", "updated": "2026-09-09T03:42:55Z", "first_seen": "2026-09-04T04:48:58Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::6815:4a5d" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "henrik.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "yandex-verification: 991fcc836a0ca8f9" }, { "ttl": 300, "type": "A", "value": "172.67.168.3" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:a803" }, { "ttl": 21600, "type": "NS", "value": "ruth.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.74.93" }, { "ttl": 21600, "type": "NS", "value": "henrik.ns.cloudflare.com" } ], "dns_at": "2026-10-25T15:27:48Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "musor.blog", "musor26.musor.blog", "*.musor26.musor.blog" ], "issuer": "Google Trust Services / WE1", "serial": "7b13729497fe7abb0eb4c7110101925f", "sha256": "53ed1da7914d6cd7802066acff982e99690111576c8a9d49d4201753448348a2", "subject": "musor.blog", "valid_to": "2026-12-20T01:48:01Z", "valid_from": "2026-09-21T00:48:04Z" }, "whois": { "registrar": "Dynadot LLC", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-09-04T03:38:58Z", "updated": "2026-09-09T03:42:55Z", "expires": "2027-09-04T03:38:58Z", "status": [ "clientTransferProhibited", "serverTransferProhibited" ], "nameservers": [ "henrik.ns.cloudflare.com", "ruth.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-04T03:38:58Z", "last changed": "2026-09-04T03:42:52Z", "registration": "2026-09-04T03:38:58Z", "registrar expiration": "2027-09-04T03:38:58Z", "last update of RDAP database": "2026-10-23T11:11:17Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T15:28:02Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "musor.blog" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T14:52:15Z", "first": "2026-10-25T14:52:15Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 6613 }, "robots_txt": { "agents": [ "*", "Yandex" ], "present": true, "sitemaps": [ "https://musor.blog/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 16 }, "social_tags": { "ogUrl": "https://musor.blog/", "title": "MUSOR DROP на musor.blog — разбор кейсов CS2 и код INVFMFEP7", "ogType": "website", "ogTitle": "MUSOR DROP на musor.blog — разбор кейсов и код INVFMFEP7", "themeColor": "#100F12", "description": "Гид musor.blog: лента дропов, кейсы CS2, апгрейд, контракт и куда вставлять INVFMFEP7. RTP 98%. 18+.", "canonicalUrl": "https://musor.blog/", "ogDescription": "Как устроены кейсы, усиление и контракт. Код INVFMFEP7 — после Steam, не в ленте." }, "trackers": { "requests": 81, "trackers": [ { "name": "Yandex", "company": "Yandex", "country": "RU", "category": "Advertising", "requests": 2 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 4 }, { "name": "Yandex Metrika", "company": "Yandex", "country": "RU", "category": "Site Analytics", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 24, "wait": 74, "connect": 12, "download": 1 }, "response_ms": 113 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 15543, "co2_grams": 0.0006, "cleaner_than": 62 }, "dns_server": { "ns": [ { "ip": "108.162.192.143", "host": "ruth.ns.cloudflare.com" }, { "ip": "172.64.35.105", "host": "henrik.ns.cloudflare.com" } ], "zone": "musor.blog" }, "cookies": { "cookies": [ { "name": "bh", "secure": true, "same_site": "None" }, { "name": "_ym_uid", "secure": true, "same_site": "None" }, { "name": "_ym_d", "secure": true, "same_site": "None" }, { "name": "sync_cookie_csrf", "secure": true, "same_site": "None" }, { "name": "_ym_isad", "secure": true, "same_site": "None" }, { "name": "sync_cookie_csrf", "secure": true, "same_site": "None" }, { "name": "_yasc", "secure": true, "same_site": "None" }, { "name": "yabs-sid", "secure": true, "session": true, "same_site": "None" }, { "name": "i", "secure": true, "http_only": true, "same_site": "None" }, { "name": "yandexuid", "secure": true, "same_site": "None" }, { "name": "yuidss", "secure": true, "same_site": "None" }, { "name": "ymex", "secure": true, "same_site": "None" }, { "name": "receive-cookie-deprecation", "secure": true, "http_only": true, "same_site": "None" }, { "name": "bh", "secure": true, "same_site": "None" } ] }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "musor.blog" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "NS": [ "henrik.ns.cloudflare.com", "ruth.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"henrik.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415441006, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "yandex-verification: 991fcc836a0ca8f9" ], "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://musor.blog" ] }, "subdomains": { "count": 23, "subdomains": [ "apgreid.musor.blog", "bonusy.musor.blog", "chestnost.musor.blog", "faq.musor.blog", "gid.musor.blog", "keisy-cs2.musor.blog", "kontrakty.musor.blog", "musor14.musor.blog", "musor19.musor.blog", "musor26.musor.blog", "musor32.musor.blog", "musor39.musor.blog", "musor4.musor.blog", "musor6.musor.blog", "musor9.musor.blog", "mystery-box.musor.blog", "novosti.musor.blog", "nozhi-cs2.musor.blog", "obzor.musor.blog", "promocod.musor.blog", "shansy.musor.blog", "vhod-steam.musor.blog", "vyvod-skina.musor.blog" ] }, "linked_pages": { "external": [ "https://musor.click/HBlQV3uh" ], "external_count": 1, "internal_count": 4 }, "whois": { "registrar": "Dynadot LLC", "created": "2026-09-04T03:38:58Z", "updated": "2026-09-09T03:42:55Z", "expires": "2027-09-04T03:38:58Z", "status": [ "clientTransferProhibited https://icann.org/epp", "serverTransferProhibited https://icann.org/epp" ], "nameservers": [ "henrik.ns.cloudflare.com", "ruth.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```