cabattle[.]com

Analysis of the domain cabattle.com indicates it was actively involved in a phishing campaign targeting users of the gaming platform CaseBattle, specifically impersonating its CS2 (Counter-Strike 2) case-opening services. The domain was registered on March 6, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolved to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States, a common tactic to obscure the true origin of malicious infrastructure. Nameservers donna.ns.cloudflare.com and rex.ns.cloudflare.com further confirm Cloudflare's role in the domain's DNS resolution.

The page title, 'CaseBattle — Официальные Кейсы CS2 | Апгрейды, Контакты и многое другое!', explicitly references CaseBattle, a platform for virtual case openings in CS2, suggesting the domain was designed to deceive users into believing it was the legitimate CaseBattle service. The use of Russian-language text in the title indicates the campaign may have targeted Russian-speaking audiences or regions where such services are popular. As of the report date, the domain appears on one security blocklist, specifically PhishDestroy, and has been flagged by 2 out of 94 security vendors on VirusTotal, confirming its classification as malicious by a subset of the security community.

The domain's SSL certificate, issued by Let's Encrypt (serial number E7), does not provide meaningful trust indicators, as Let's Encrypt certificates are automatically issued and widely used across both legitimate and malicious domains. The current status of cabattle.com is offline, which may indicate takedown actions or voluntary cessation of operations by the threat actors. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns.