focredrop[.]com

PhishDestroy has identified focredrop.com as a generic phishing threat posing as a CS:GO case opening platform, likely impersonating legitimate services like ForceDrop. The site was designed to trick users into connecting their Steam accounts or making payments for fake in-game items, potentially leading to credential theft or financial loss. The domain was created on March 8, 2026, just weeks before being flagged, indicating a short-lived but aggressive campaign targeting gamers.

Technical indicators for this domain include a VirusTotal detection rate of 4 out of 95 security vendors, meaning a small but notable minority flagged it as malicious. The domain is registered through Global Domain Group LLC and resolves to IP address 188.114.97.3, which is associated with Cloudflare's CDN, commonly used to obscure the true hosting location. The SSL certificate was issued by Let's Encrypt, a free certificate authority often abused by malicious sites. Additionally, the domain appears on one security blocklist and is currently offline, likely due to a takedown action by the registrar or hosting provider.

As of the latest assessment, the domain has been taken offline, reducing the immediate risk to users. However, remnants of the site may still be accessible through cached pages or similar domains. Users who may have visited the site should monitor their Steam accounts for unauthorized activity and avoid reusing passwords. PhishDestroy recommends always verifying the legitimacy of CS:GO case opening sites through official channels and using unique credentials for gaming platforms.