mycsgosite[.]com

Analysis confirms that mycsgosite.com is being used as a high‑risk phishing platform targeting players of CS2/CS:GO. The site presents a Russian‑language storefront that mimics legitimate case‑opening services, aiming to harvest credentials from visitors seeking in‑game drops. The domain was registered on 5 Mar 2026 through a popular registrar and is currently active, returning HTTP 200 over TLS with a certificate issued by a widely trusted authority. Infrastructure investigation shows the domain resolves to 188.114.96.3, an address allocated to a large content‑delivery network operating in the United States. DNS is served by two authoritative nameservers, both belonging to the same CDN provider. The web application stack is identified as Node.js running on Meteor with a MongoDB backend, and the server advertises HTTP/3 support. No anomalous ports or services beyond standard web traffic are observed. Threat intelligence feeds report that 2 of 95 security scanners on VirusTotal flagged the site as malicious, and an independent trust‑score service assigned a score of 0 out of 100. The domain appears on at least one anti‑phishing blocklist, and a dedicated phishing‑mitigation platform has already blocked access to it. These indicators, combined with the deceptive page title “MYCSGO — кейсы МАЙКСГО CS2/CS:GO, топ‑дроп”, align with known credential‑harvesting campaigns targeting the gaming community. Defenders should add the domain and its resolving IP to outbound‑filter rules and blocklist them at the network perimeter. Incident response teams should monitor for related credential submissions and consider user‑education campaigns warning about fake case‑opening sites. Continuous scanning of the associated IP range and periodic re‑assessment of the site’s reputation are recommended to detect any evolution of the threat.