upgrader1[.]live

Analysis of the domain upgrader1.live indicates it is an active phishing site targeting users of Counter-Strike 2 (CS2) and Counter-Strike: Global Offensive (CS:GO) skin trading services. The domain was registered on June 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains operational as of July 12, 2026. The page title, "Топ сервис Апгрейдер скинов CS2 и CS:GO | Быстрый апгрейд предметов на Upgrader 1," explicitly references CS2 and CS:GO skin upgrades, suggesting an attempt to deceive users into submitting in-game item credentials or financial details under the guise of a legitimate trading service. Infrastructure analysis reveals the domain resolves to IP address 172.67.157.63 and employs Cloudflare for hosting and security, including HTTP/3 and HSTS. The SSL certificate is issued by Google Trust Services, which does not inherently indicate malicious activity but is commonly used by threat actors to lend false legitimacy. The domain is flagged on one security blocklist and appears in four AlienVault OTX threat intelligence pulses, confirming its classification as malicious by multiple sources. VirusTotal reports five security vendors flagging the domain out of 95, further supporting its high-risk status. The domain utilizes PHP and Unpkg technologies, which are frequently exploited in phishing campaigns for dynamic content delivery and obfuscation. No specific phishing kit or brand impersonation beyond the referenced CS2/CS:GO context is confirmed at this time. Defenders should treat this domain as a confirmed phishing threat, block it at the network level, and monitor for related indicators of compromise, including the associated IP address and SSL certificate details. Given its recent registration and active status, continued monitoring for evolving tactics or additional infrastructure is recommended.