clashegg[.]com

This domain, clashegg.com, is identified as a credential theft operation targeting users of Counter-Strike 2 (CS2) skin gambling platforms. Analysis of the page title, 'CS2 Cases, Celebrate our anniversary with new exciting events!', indicates an attempt to impersonate legitimate CS2 case-opening services, a common tactic to harvest user credentials and payment information. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft campaigns designed to compromise accounts on gaming and gambling platforms. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 172.67.158.100. Security vendor assessments on VirusTotal flag the domain as malicious, with 4 out of 95 vendors detecting it as a threat. The domain appears on one security blocklist and was included in a single AlienVault OTX threat intelligence pulse. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. No Google Safe Browsing (GSB) status is available for this domain at the time of analysis. As of the latest assessment, clashegg.com has been taken offline, likely in response to security vendor detections and blocklist inclusions. However, the domain remains registered, and the infrastructure could be reactivated or repurposed for similar credential theft campaigns. Users who may have interacted with this domain are advised to reset passwords for any associated accounts, enable multi-factor authentication, and monitor for unauthorized transactions. The elevated risk level persists due to the domain's registration remaining active and the potential for future malicious use.