cggoempire[.]com

This domain operates as a fraudulent counterfeit of legitimate CS:GO skin gambling platforms, targeting users with promises of instant item withdrawals. Analysis indicates the site mimics the branding and functionality of established gaming item trading services, specifically CSGO EMPIRE, to deceive victims into depositing virtual items or funds under false pretenses. The threat category is classified as generic_phishing with a focus on virtual asset theft, where users are lured into engaging with fake gambling mechanics that either steal deposited items or fail to provide withdrawals after collecting user assets. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to IP address 172.67.129.56 and is currently flagged by 2 out of 95 security vendors on VirusTotal. It appears on one security blocklist and was previously blocked by PhishDestroy. The page title, 'CSGO EMPIRE — Open CS2, CS:GO cases with instant withdrawal of items!', directly impersonates the legitimate platform, increasing the likelihood of successful social engineering attacks. Users who visited cggoempire.com should immediately revoke any active sessions or connected accounts, particularly those linked to Steam or other gaming platforms. All credentials used on the site should be considered compromised and reset across all services. If virtual items or funds were deposited, victims should report the incident to the legitimate platform being impersonated and to relevant gaming community fraud reporting channels. Monitoring for unauthorized transactions or account access is recommended, as the operators may attempt to reuse stolen credentials on other platforms. The domain is currently offline, but users should remain vigilant for similar phishing attempts using comparable domain names or branding.