ggddrop[.]com

Analysis indicates that ggddrop.com is an active phishing domain targeting users of the popular first-person shooter game Counter-Strike 2 (CS2), as suggested by its page title 'GGDROP — Кейсы КС2 - Официальный Сайт, Лучший Дроп и Поборки Наборов.' The domain was registered on March 5, 2026, and currently resolves to IP address 172.67.202.175, which is part of Cloudflare's network (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers (weston.ns.cloudflare.com, yolanda.ns.cloudflare.com) and a Let's Encrypt SSL certificate, which are common among both legitimate and malicious sites. The domain is hosted on Cloudflare's infrastructure, a tactic frequently employed by threat actors to obscure the true origin and enhance resilience against takedowns. One security vendor has flagged ggddrop.com on VirusTotal, while the domain is also blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious. The site employs modern web technologies, including Unpkg, AOS, and HTTP/3, which are not inherently malicious but are often used to create convincing phishing pages. The domain's registration through NiceNIC International Group Co., Limited, a registrar commonly associated with abusive domains, adds to the suspicion. Defenders should treat this domain as high-risk. While the exact content and functionality of the site have not been fully analyzed, the presence of CS2-related terminology in the page title suggests it may attempt to deceive users into providing login credentials, payment details, or other sensitive information under the guise of offering in-game skins or cases. Network-level blocking and monitoring for connections to 172.67.202.175 or the domain itself are recommended. Given the domain's recent creation and active status, continued vigilance and updates to detection rules are advised.