uppgrader[.]com

Uppgrader.com was registered on 23 April 2026 through Global Domain Group LLC and resolves to the Cloudflare IP address 188.114.97.3 located in Canada. The domain is served by the Cloudflare nameservers miki.ns.cloudflare.com and tosana.ns.cloudflare.com and presents a valid Let’s Encrypt certificate (issuer E8). A direct request to the site returns HTTP 200 and delivers a page whose title reads “UPGRADER :: Официальный Сайт - CS2 Апгрейд скинов КС2 (КС ГО): лучший Upgrader CS”. The title explicitly references “CS2” and “Upgrader”, indicating an attempt to masquerade as an official Counter‑Strike 2 skin upgrade service. The domain has been observed in three separate AlienVault OTX pulses and is currently listed on one external security blocklist. PhishDestroy has also marked the domain as blocked. Despite these indicators, VirusTotal reports zero detections out of 95 scanners, and Gridinsoft’s trust score is 0 / 100, reflecting a lack of known malicious payloads but a low reputation. The absence of detections on VirusTotal does not guarantee safety; the low trust score and inclusion in threat‑intel feeds suggest that the infrastructure is being used for phishing or credential‑harvesting campaigns, likely leveraging the popular CS2 brand to lure victims. The use of Cloudflare’s CDN and a recent Let’s Encrypt certificate can obscure the true origin of the malicious content. Defenders should add uppgrader.com to network and email block lists, monitor DNS queries for the domain, and consider sinkholing the IP address if feasible. Continuous telemetry collection on any requests to the site, especially from users of the Counter‑Strike 2 ecosystem, is recommended to detect possible credential‑theft attempts.