csgoemlpire[.]com

Analysis of csgoemlpire.com shows a newly registered domain (created 2026-03-05) hosted on Cloudflare infrastructure (IP 188.114.97.3, AS13335, United States). The domain resolves to a Cloudflare IP with no TLS certificate presented, indicating that HTTPS is not configured. The public page title returned by the site reads "Premium digital collections with instant delivery to your account!", a phrasing commonly used in fraudulent offers. Nameserver delegation points to agustin.ns.cloudflare.com and linda.ns.cloudflare.com, both owned by Cloudflare, confirming the use of a popular CDN for fast DNS resolution and possible masking of origin. VirusTotal has recorded four detections out of ninety‑five scanners, confirming that multiple security products have identified malicious behavior associated with the domain. The domain appears on a single security blocklist, PhishDestroy, which has actively blocked it. Registration was performed through NiceNIC International Group Co., Limited, a registrar that does not provide additional public verification of the registrant’s identity.

The current operational status is reported as offline, suggesting that the malicious content has been removed or the site is temporarily inaccessible. However, the historical evidence—recent registration, lack of TLS, phishing‑oriented page title, multiple vendor detections, and blocklist inclusion—indicates that the domain was used for a generic phishing campaign targeting users with promises of digital collectibles. No further technical artifacts such as malware hashes, command‑and‑control endpoints, or exploit kits have been disclosed, leaving the full scope of the campaign uncertain.

Defenders should continue to block csgoemlpire.com at network perimeter and DNS filtering layers, monitor for any re‑hosting of the domain on alternative IP addresses, and incorporate the observed indicators (IP 188.114.97.