upgrader1[.]net

This domain, upgrader1.net, is flagged as a high-risk phishing site targeting users of Counter-Strike 2 (CS2) and Counter-Strike: Global Offensive (CS:GO) skin trading platforms. Analysis of the page title, "Лучший сайт Апгрейдер скинов CS2 и CS:GO | Честный апгрейд предметов на Upgrader 1," indicates an attempt to impersonate legitimate skin upgrading services, likely to harvest user credentials or facilitate fraudulent transactions. No direct evidence of a crypto drainer kit was observed, but the domain exhibits characteristics consistent with credential phishing and brand impersonation tactics commonly used in gaming-related fraud schemes. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 172.67.186.214. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. No listings were found on Google Safe Browsing (GSB) at the time of analysis, and no additional blocklist entries beyond the VirusTotal detections were identified. The domain remains active as of the latest verification, posing an ongoing risk to users who may encounter it through phishing links or malicious advertisements. Recommended response actions include blocking the domain and associated IP at the network perimeter, updating endpoint protection signatures to include the domain, and alerting users to the presence of fraudulent CS:GO skin trading sites. Despite the low detection rate on VirusTotal, the domain's creation date, registrar, and targeted content justify its classification as high-risk. Continuous monitoring is advised to track any changes in infrastructure or detection status.