upgrader1[.]com

This domain, upgrader1.com, is flagged as a phishing site specializing in Counter-Strike 2 (CS2) skin scams, a form of brand impersonation targeting in-game virtual assets. The site is currently offline, though prior activity suggests it operated as a fraudulent skin upgrade platform, likely harvesting user credentials or payment details under the guise of legitimate CS2 services. Analysis indicates the domain was designed to deceive users into believing it was an official or authorized platform for trading, upgrading, or purchasing CS2 skins, a common tactic in gaming-related phishing schemes. Infrastructure analysis reveals the domain was created on February 21, 2026, and registered through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.21.118, a Cloudflare-associated address often leveraged to obfuscate hosting origins. The page title, "АПГРЕЙДЕР | Официальный Сайт UPGRADER - Апгрейдер Скинов CS2!," explicitly claims official status in Russian, further indicating a targeted approach toward Russian-speaking CS2 players. VirusTotal detection metrics show 4 of 95 security vendors flagged the domain as malicious, while it appears on a single security blocklist, specifically PhishDestroy. The discrepancy between vendor detections and blocklist presence suggests the threat was either newly identified or lacked widespread visibility at the time of assessment. The domain’s current offline status reduces immediate risk, though historical activity and infrastructure warrant continued monitoring. Organizations and individuals are advised to block the domain and its associated IP (104.21.21.118) at the network level, particularly in environments with gaming-related traffic. End users should verify the legitimacy of any CS2 skin trading or upgrade platforms through official channels, avoiding domains with recent creation dates or those lacking verifiable ties to Valve Corporation or authorized partners. Given the elevated risk level, security teams are encouraged to review logs for prior connections to upgrader1.com and conduct retrospective analysis for credential theft or unauthorized transactions linked to this domain.