csruun[.]com

This domain is flagged as an elevated-risk phishing site specializing in CS:GO gambling credential theft. Analysis indicates the infrastructure was designed to impersonate the legitimate "КСГОРАН" (CSGORUN) platform, a known gambling service targeting Counter-Strike: Global Offensive players, particularly within Russian-speaking communities. The page title, "КСГОРАН официальный сайт CSGORUN, перейти на сайт КС ГО РАН," explicitly mimics official branding to deceive victims into entering account credentials or financial details under false pretenses.

Infrastructure analysis reveals the domain csruun.com was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The site resolved to the IP address 188.114.96.3 and was detected by 1 of 95 security vendors on VirusTotal, indicating limited but targeted malicious recognition. It appeared on a single security blocklist and was referenced in one AlienVault OTX threat intelligence pulse, suggesting early-stage detection before broader dissemination. The domain was subsequently taken offline, though residual DNS or cached records may persist in certain networks.

Mitigation for this threat type requires multi-layered defenses. Network administrators should implement DNS-based blocking for csruun.com and its associated IP (188.114.96.3) across perimeter security controls. Endpoint protection systems should be updated to include this domain in phishing and credential theft detection rules. Organizations targeting gaming or gambling sectors should conduct user awareness training emphasizing the risks of spoofed gambling platforms, particularly those using Cyrillic or mixed-language branding. Incident response teams should monitor for credential reuse from compromised accounts, as stolen CS:GO inventory or payment details may be leveraged in secondary fraud schemes.