casebattle[.]info

This domain, casebattle.info, poses as a Counter-Strike 2 (CS2) case opening platform, luring users with promises of in-game item drops and gambling-style rewards. Analysis indicates the site employs phishing tactics to harvest user credentials, payment details, or install malicious software under the guise of a legitimate gaming service. The page title, "CASE-BATTLE — Официальная Платформа, Кейсы КС2 с Шансом и Дропом для Всех!," explicitly targets Russian-speaking users, suggesting a regional focus for this campaign. The threat extends beyond credential theft, as similar domains have been linked to crypto drainers or malware distribution in past incidents involving gaming-related phishing schemes.

Evidence supporting the malicious classification includes detection by 14 out of 95 security vendors on VirusTotal, a trust score of 0/100, and presence on one security blocklist. The domain was registered on March 05, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to IP address 172.67.159.128, hosted behind Cloudflare, which is commonly used to obfuscate the true origin of malicious sites. Technologies detected include Unpkg, AOS, and HTTP/3, which may facilitate dynamic content delivery or exploit vulnerabilities in client-side security controls. The domain was taken offline, but its prior activity and registration details remain concerning.

Users who visited casebattle.info or interacted with its content should immediately revoke any permissions granted to the site, such as browser notifications or installed extensions. Scan systems with updated security tools to detect potential malware or unauthorized modifications. Reset credentials for any accounts accessed during the visit, particularly gaming platforms, payment services, or email accounts. Monitor financial transactions for unauthorized activity, as phishing domains of this nature often target cryptocurrency wallets or payment information. Report the domain to relevant security teams or blocklist providers to aid in broader threat mitigation efforts.