cscybershoke[.]com

Analysis of the domain cscybershoke.com indicates it was a fraudulent site impersonating a Counter-Strike 2 (CS2) gaming server platform, specifically targeting Russian-speaking users based on the page title 'CYBERSHOKE – Серверы КС 2 (CS2)'. The domain was registered on March 5, 2026, through NiceNIC International Group Co., Limited, and resolved to IP address 58.64.137.69, hosted on AS17444 (HKBN Enterprise Solutions Limited) in Hong Kong. No SSL certificate was present, increasing the risk of unencrypted data interception. Nameservers were listed as expired-ns1.niceisp.com and expired-ns2.niceisp.com, suggesting potential infrastructure instability or abandonment.

The domain was flagged by one security blocklist (PhishDestroy) and classified as a crypto scam, though the exact mechanics of the fraud remain unconfirmed due to the site's current offline status. VirusTotal detections were minimal, with only 2 of 94 security vendors identifying the domain as malicious, indicating limited but existing awareness among detection platforms. The domain's infrastructure, including its hosting provider and nameserver configuration, aligns with patterns observed in short-lived phishing campaigns. Defenders should treat this domain as a confirmed malicious indicator, particularly for organizations monitoring gaming-related fraud or crypto scams targeting Russian-speaking audiences.

Network-level blocking of the IP 58.64.137.69 and domain cscybershoke.com is recommended. Further investigation into associated infrastructure (e.g., hosting provider, registrar) may reveal additional linked threats. Given the domain's offline status, historical DNS and WHOIS records should be preserved for forensic analysis if related activity resurfaces.