csggoempire[.]com

This domain, csggoempire.com, operates as a targeted phishing platform designed to steal Counter-Strike: Global Offensive (CS:GO) skin credentials and in-game assets. Analysis indicates the site employs fraudulent Steam login interfaces and fake trade offer pages to harvest user authentication tokens, enabling unauthorized access to victims' inventory. The threat extends beyond credential theft, as compromised accounts are often drained of high-value virtual items, which are subsequently liquidated on underground marketplaces for financial gain. The campaign demonstrates a focused effort to exploit the CS:GO community, leveraging social engineering tactics such as fake giveaways and impersonation of legitimate skin trading platforms. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. The domain resolves to the IP address 172.67.192.93, which is part of a content delivery network known to obscure hosting origins. Detection metrics indicate elevated risk: VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and has been documented in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious activity. The registrar's history and the domain's rapid takedown further corroborate its use in a short-lived, high-impact phishing operation. Users who visited csggoempire.com or entered credentials on the site should immediately revoke active Steam sessions and enable multi-factor authentication (MFA) via the Steam Guard app. All passwords associated with the account must be reset, and any recent trade offers or inventory changes should be reviewed for unauthorized activity. Victims are advised to report the incident to Steam Support and monitor their account for signs of persistent compromise, such as unrecognized login attempts or missing items. Given the domain's offline status, users should remain vigilant for similar phishing attempts, particularly those impersonating CS:GO trading platforms or promotional events.