ggdorp[.]com

This domain, ggdorp.com, is identified as a credential theft operation targeting users of the Counter-Strike gaming franchise, specifically CS2 and CS:GO. The site impersonates an official skin gambling platform, luring victims with promises of in-game case openings and rare item rewards. Analysis of the page title, "GGDROP :: Официальный Сайт Кейсов CS2, CS:GO открывай кейсы кс2, кс го и получай лучшее!", confirms the fraudulent scheme, which likely harvests login credentials and payment details under the guise of legitimate gaming transactions. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on March 8, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which has been flagged in prior malicious campaigns. Detection metrics include a VirusTotal score of 15/95 security vendors, a Gridinsoft trust score of 0/100, and inclusion on one security blocklist. The domain is also blocked by PhishDestroy, further corroborating its malicious classification. As of the latest assessment, ggdorp.com has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate to newly registered lookalike domains. Users are advised to verify the legitimacy of gaming-related platforms through official channels and employ multi-factor authentication to mitigate credential theft risks. Monitoring for similar domains registered under the same registrar or resolving to the same IP address is recommended for proactive defense.