garlinghouse-25[.]com

This domain, garlinghouse-25.com, is flagged as a high-risk brand impersonation threat targeting users of the CS2 gaming platform. Analysis indicates the site masquerades as a cryptocurrency giveaway allegedly endorsed by Brad Garlinghouse, a known public figure in the blockchain space. The page title explicitly states 'Biggest giveaway of $100,000,000 from Brad Garlinghouse,' a tactic designed to exploit user trust in prominent industry names to facilitate fraudulent asset transfers. No legitimate association with CS2 or the named individual has been verified, and the domain exhibits characteristics consistent with cryptocurrency drainer kits, which automatically siphon digital assets from connected wallets. Infrastructure analysis reveals the domain was registered on September 11, 2025, through ERANET INTERNATIONAL LIMITED, an offshore registrar frequently utilized in high-risk campaigns. The domain resolves to the IP address 104.21.32.1, a Cloudflare proxy endpoint commonly employed to obfuscate hosting origins. Detection metrics indicate 12 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while Google Safe Browsing has classified it under the 'SOCIAL_ENGINEERING' category. The domain appears on one security blocklist, and Gridinsoft assigns it a trust score of 0 out of 100, further corroborating its malicious intent. The use of a proxy IP and offshore registration aligns with patterns observed in large-scale phishing operations targeting cryptocurrency users. As of the latest assessment, garlinghouse-25.com has been taken offline, likely in response to detection by security systems such as PhishDestroy. However, the infrastructure remains a residual risk, as domains registered through the same registrar and resolving to similar proxy IPs have historically resurfaced under new names. Users who interacted with the domain prior to its takedown may still be exposed to follow-up attacks, including credential harvesting or malware distribution. To mitigate risk, affected individuals should revoke any wallet permissions granted during the interaction, monitor accounts for unauthorized transactions, and verify the legitimacy of future communications through official CS2 channels. The domain's creation date and rapid flagging by multiple security vendors underscore the need for heightened vigilance against similar impersonation schemes.