cybershoie[.]com

This domain, cybershoie.com, is identified as a counterfeit Counter-Strike server phishing site designed to deceive users into disclosing credentials or downloading malicious payloads. Analysis confirms the domain is currently offline, though prior activity exhibited clear fraudulent intent targeting gaming communities. Infrastructure analysis reveals the domain was flagged by 8 of 95 security vendors on VirusTotal, with additional presence on one security blocklist. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, the domain resolved to the IP address 104.21.36.237, hosted via a content delivery network in Canada. The SSL certificate, issued by Google Trust Services under the identifier WE1, provided a false sense of legitimacy. The page title, "CYBERSHOKE – Серверы КС 2," explicitly mimicked legitimate Counter-Strike server listings to enhance credibility. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Security teams are advised to monitor network logs for connections to 104.21.36.237 and the domain cybershoie.com, as these serve as concrete indicators of compromise. Users should verify server authenticity through official channels and report any suspicious activity to relevant security providers. Proactive measures, including domain reputation checks and endpoint detection rules, are recommended to mitigate similar threats.