upgraders[.]pro

Analysis of upgraders.pro indicates an active generic_phishing campaign classified as high risk. The domain was registered on May 13, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is served by the nameservers ns1.adminvps.ru, ns2.adminvps.net, ns3.adminvps.ru, and ns4.adminvps.net. DNS resolution points to IP address 5.253.61.77, which belongs to AS211642 AdminVPS OOO located in Russia. The site presents an HTTP 200 response and uses a Let’s Encrypt R12 TLS certificate. The page title, rendered in Cyrillic, reads “Апгрейд скинов КС2 (КС ГО): лучший Upgrader CS,” suggesting a lure targeting users of the CS:GO game. VirusTotal records show that 2 of 91 security vendors have flagged the domain, and it appears on a single external blocklist. PhishDestroy has already added the domain to its blocklist. No additional content analysis is available beyond the title, leaving the exact phishing payload and credential collection mechanisms unconfirmed. Defenders should block both the domain and its resolved IP, monitor for related DNS queries, and consider adding the associated ASN to network‑level deny lists. Continuous observation is advised to detect any future infrastructure changes or escalation of malicious activity.