mycaser[.]com

This domain, mycaser.com, is flagged as an active credential theft operation targeting Counter-Strike 2 (CS:GO) players. Analysis indicates the site impersonates legitimate gaming asset platforms by offering fake 'CS2 skin upgrades' to harvest login credentials for Steam accounts and in-game inventories. The page title explicitly claims to be an 'official site' for CS:GO skin upgrades, a common tactic to build false trust with victims. No crypto drainer or payment skimming functionality has been observed, distinguishing this as a focused credential harvesting campaign rather than a financial fraud scheme. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.218.91, a Cloudflare proxy endpoint, and was registered on June 9, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. VirusTotal reports 0 detections across 95 engines, and no Google Safe Browsing flags or blocklist entries have been recorded as of this assessment. The site employs Cloudflare Browser Insights for performance monitoring and HTTP/3 for transport, while its SSL certificate is issued by Google Trust Services, further masking its malicious intent behind legitimate infrastructure. Current status remains active, with no takedown or sinkholing observed. The domain continues to resolve and serve content through Cloudflare's network, presenting an ongoing risk to users. Recommended response actions include immediate blocklisting at the network level, submission to threat intelligence platforms for broader detection, and user education targeting gaming communities about fake skin upgrade sites. Despite the lack of antivirus detections, the combination of brand impersonation, credential harvesting indicators, and active status warrants high-risk classification until mitigation is confirmed.