mycsgo[.]live

This domain, mycsgo.live, is identified as a generic phishing infrastructure targeting users of the popular first-person shooter game Counter-Strike 2 (CS2). The site masquerades as an official platform for in-game case openings, using localized branding in Russian (МАЙКСГО Официальный Сайт) to deceive victims into entering login credentials, payment details, or downloading malicious software. The page title, MYCSGO — кейсы CS2, directly references CS2 cases, a common monetization method in gaming communities, suggesting the threat actors are exploiting the microtransaction economy to harvest sensitive user data. No specific drainer kit has been conclusively linked to this domain at this time, though the infrastructure aligns with patterns observed in credential-harvesting campaigns targeting gaming audiences. Analysis of technical indicators reveals multiple red flags. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains due to its lenient registration policies. It resolves to the IP address 188.114.96.3, which has been previously observed in other phishing campaigns, though no direct attribution to bulletproof hosting has been confirmed. On VirusTotal, 7 out of 95 security vendors flag mycsgo.live as malicious, with detections including phishing, fraud, and potentially unwanted program (PUP) classifications. The domain appears on one security blocklist and was referenced in a single AlienVault OTX threat intelligence pulse, indicating limited but confirmed malicious activity. Gridinsoft assigns the domain a trust score of 0/100, further corroborating its high-risk status. Notably, the domain is not currently listed on Google Safe Browsing (GSB), which may have allowed it to evade detection by some endpoint protections. As of the latest verification, mycsgo.live has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. The domain was blocked by PhishDestroy, suggesting proactive takedown efforts. However, the remaining risk persists due to the potential for threat actors to re-establish infrastructure under a new domain or IP address. Users who interacted with the site prior to its takedown may still be at risk of credential compromise, financial fraud, or malware infection. Organizations and individuals are advised to monitor for unauthorized access to gaming accounts, enable multi-factor authentication (MFA) on all platforms, and review transaction histories for suspicious activity. Network defenders should update blocklists to include the domain and associated IP address, while security teams should investigate any prior connections to 188.114.96.3 within their logs. Given the domain's recent creation date, further monitoring of newly registered domains with similar naming conventions is recommended.