hlztv[.]com

This domain, hlztv.com, is currently under investigation for operating as a Counter-Strike 2 credential phishing site. Analysis indicates the infrastructure was designed to mimic the legitimate HLTV.org esports portal, targeting users seeking Counter-Strike 2 news and statistics. The page title, 'HLTV.org - Official Counter-Strike 2 News and Statistics - Esports Portal,' directly replicates the authentic site, increasing the likelihood of successful deception among esports enthusiasts. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and has been flagged in 8 threat intelligence pulses on AlienVault OTX. Despite a current VirusTotal detection rate of 0/95, the domain appears on 2 security blocklists and holds a Gridinsoft trust score of 0/100. The discrepancy between blocklist presence and VirusTotal detections suggests the campaign may still be in an early or evasive phase. Mitigation against this specific threat type involves implementing DNS-based blocking for the domain and its associated IP address. Network administrators should prioritize monitoring for connections to 188.114.97.3 and alerting users who attempt to access hlztv.com. End users should verify domain authenticity before entering credentials, particularly on sites claiming affiliation with esports platforms. Organizations are advised to review logs for prior interactions with this domain and conduct password resets for accounts potentially exposed to the phishing attempt.