clasmgg[.]com

The domain clasmgg.com was identified as a phishing site targeting users of the Counter-Strike 2 (CS2) skin gambling ecosystem. Analysis indicates this domain was designed to impersonate legitimate CS2 case-opening platforms, leveraging social engineering tactics such as anniversary celebrations and exclusive events to deceive victims. The domain is currently offline, though historical activity suggests it was operational for a limited period to facilitate credential theft or fraudulent transactions. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusually future-dated registration that may indicate typosquatting or preemptive domain squatting. The domain resolved to the IP address 172.67.220.152, a Cloudflare-associated address commonly used to obfuscate hosting origins. Security vendor detections were significant, with 7 of 95 VirusTotal engines flagging the domain as malicious. Additional threat intelligence sources confirm its presence on one security blocklist and one AlienVault OTX pulse. The domain’s trust score, as assessed by Gridinsoft, was 0 out of 100, further corroborating its high-risk classification. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure remains a potential threat vector, particularly if re-registered or repurposed. Organizations and individuals are advised to block the domain and its associated IP at the network level to prevent accidental exposure. End-users should be educated on recognizing gambling-related phishing lures, particularly those exploiting gaming communities. Monitoring for similar domains registered under the same registrar or resolving to the same IP range is recommended for proactive threat mitigation.