# PhishDestroy domain threat record: musor3.win Content language: English Canonical HTML report: https://phishdestroy.io/domain/musor3.win/ Machine-readable companion: https://phishdestroy.io/domain/musor3.win/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-06 21:59:01 UTC - Last availability or vendor check: 2026-10-21 01:18:17 UTC - Stored record updated: 2026-10-22 14:23:29 UTC - VirusTotal detections in the stored snapshot: 5/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: cs2 ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registration date (registry RDAP, musor3.win): 2026-08-29 21:35:23 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a078b9-8b0c-7535-a247-f4692a014417/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/musor3.win - Certificate Transparency search: https://crt.sh/?q=%25.musor3.win - Web Archive lookup: https://web.archive.org/web/*/https://musor3.win/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview musor3.win presented itself as "Musor Drop", a Russian-language CS2 case-opening site promising cases, skin upgrades and freebies ("халява"). PhishDestroy classifies it as an impersonation phishing page that exploits the Counter-Strike 2 brand to target players and their Steam inventories. We first flagged it on 2026-09-06. The site has been offline since 2026-09-24 and was still unreachable when last checked on 2026-10-19. How the scam works Fake CS2 case sites use free cases, daily bonuses and "upgrade" mechanics to get players to sign in. The login step is usually a counterfeit "Sign in through Steam" window that captures the Steam username, password and Steam Guard code. Some versions also ask for deposits of skins or money. With access to the account, operators empty the inventory through trades or tamper with account settings so items keep flowing to them. The victim can lose the Steam account, every skin in it, and any money deposited for "cases" that never pay out. Evidence On 2026-09-20, five of 89 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a modest count, but five independent vendors agreed within weeks of registration. The domain also appears in four AlienVault OTX threat pulses, which shows other researchers tracked it too. Among the blocklists we checked, only PhishDestroy lists it. Infrastructure The domain was registered on 2026-08-29, and we flagged it eight days later. The site was offline less than a month after registration. That short lifespan is typical of disposable scam domains that are abandoned and replaced once they are flagged. Traffic ran through Cloudflare, with the address geolocated to Canada, so the real origin server is hidden behind the proxy. What to do If you signed in through this site, change your Steam password right away and re-secure Steam Guard. Then use "Deauthorize all other devices" to end any hijacked sessions. Check your Steam Web API key page and revoke any key you did not create, since stolen keys are often used to intercept trade offers. Review recent trade history and pending offers, and report the account compromise to Steam Support. If you paid money for cases, contact your payment provider about a chargeback. Defenders should block the domain, warn gaming communities about CS2 "free case" lures, and watch for new lookalike case sites built on the same Musor Drop branding. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a078b9-8b0c-7535-a247-f4692a014417/ VirusTotal report: https://www.virustotal.com/gui/domain/musor3.win Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=musor3.win Archived copy: https://web.archive.org/web/20260917003508/https://musor3.win/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:22:06 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a078b9-8b0c-7535-a247-f4692a014417.png Captured: 2026-09-06 21:59:01 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a078b9-8b0c-7535-a247-f4692a014417.png Captured: 2026-09-06 21:59:01 UTC Source report: https://urlscan.io/result/01a078b9-8b0c-7535-a247-f4692a014417/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9f75231a-9fc5-488f-9203-e41be10a779d.png Captured: 2026-09-06 22:31:10 UTC Source report: https://radar.cloudflare.com/scan/9f75231a-9fc5-488f-9203-e41be10a779d SHA-256: 5fbfb8ef0283dbd910380a46933c5f9446bf57f034728bfa1ab614acdfea1719 - URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a078b8-d063-77cc-8e1d-e7e298c247be.png Captured: 2026-09-06 21:56:21 UTC Source report: https://urlscan.io/result/01a078b8-d063-77cc-8e1d-e7e298c247be/ SHA-256: 5647817c26131f9e06c2e19090760996ddb9ce5cb2b1f26b1ee6311690618feb ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T02:29:48Z", "uuid": "01a078b9-8b0c-7535-a247-f4692a014417", "scanned_at": "2026-09-06T21:57:09Z", "final_url": "https://musor3.win/", "status": 200, "ip": "188.114.97.3", "domains": [ "community.akamai.steamstatic.com", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.13.94", "2.23.176.174", "142.251.20.95", "2.23.176.185", "188.114.97.3" ], "asns": [ "15169", "20940", "13335" ], "countries": [ "US", "DE" ], "link_domains": [ "t.me" ], "social": [ "https://t.me/musr_support" ], "doc_hash": "b9a49d882994ca0c97fb511b2414aea86f10f5c0e81a22181d30b493a597274a", "script_hashes": [ "207623d68dbfe085409e6c6a6f213934ee965ea0f1e3f69137d07296a28f1469", "160d3a8e9743bcdba8929f1f4a80a83c787bee7be2b7344600a66345239593eb", "4b740ee1d3b802e048d2ed13e923156c15e802ab89e429886e15a368c3204736", "b7848d0133489d3c287d8ff49d514a5f3117ea118d41845bb7d1ba60e642803f", "30a47831250fa248d7d7fc20fe660ba45e85171ec7808992ad5d40d67ad33211", "5ead4b354a332d01093af3d81f4275e58c53e07c6961f63860807fc90cc22237", "7d27b6ef3360d1b06fccd5669bb8693ba07815757363a9b17d8d98fdc94d2723", "4c8e2e0173b7b3edcff7e457464b48991b9ca71375ab2325c8f6f04309d5d6ae", "61e9fc088f5b7aec61ef61ac99ea2b6124c7f5a438fa0b7851a4a6aef5e8c545", "d0bd4b0fc7d79a08cef3d355b7bfe1040146c112eef1dd1d42719ac50d1aac99" ], "globals": [ "$R", "nanostoresGlobal", "__TSR_ROUTER__", "__TSS_START_OPTIONS__" ], "storage_keys": [ "musor_vid" ], "tls": { "san": [ "musor3.win", "*.musor3.win" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "musor3.win", "protocol": "QUIC", "valid_to": "2026-11-30T14:17:01Z", "valid_from": "2026-09-01T13:20:06Z" }, "domain_age_days": 7, "apex_age_days": 7, "tls_age_days": 5, "tls_valid_days": 90, "requests": 81, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T03:58:43Z", "uuid": "9f75231a-9fc5-488f-9203-e41be10a779d", "scanned_at": "2026-09-06T22:31:10Z", "final_url": "https://musor3.win/", "status": 200, "history": [ { "url": "https://musor3.win/", "status": 200 } ], "dom_hash": "c1199237fde849d8850ea56a732bc7ba1265139961f44f3b627ade2ef0ad3a22", "doc_hash": "a8d6c7fb410072d8cce8ab4f8a330a95c4419508ed203228196ce48a5511e966", "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "musor3.win", "type": "A", "value": "172.67.178.6" }, { "name": "musor3.win", "type": "A", "value": "104.21.43.102" }, { "name": "musor3.win", "type": "AAAA", "value": "2606:4700:3037::6815:2b66" }, { "name": "musor3.win", "type": "AAAA", "value": "2606:4700:3030::ac43:b206" } ], "dnssec_valid": false, "ip": "172.67.178.6", "whois": { "registrar": "Spaceship, Inc.", "created": "2026-08-29T21:35:23Z", "updated": "2026-09-03T21:35:26Z", "expires": "2027-08-29T21:35:23Z", "nameservers": [ "kenia.ns.cloudflare.com", "johnathan.ns.cloudflare.com" ] } } } ```