csgoempiremirror[.]com

PhishDestroy’s investigation has flagged csgoempiremirror.com as a counterfeit mirror site designed to harvest CS:GO Empire account credentials via phishing. The domain mimics the legitimate csgoempire.com platform, tricking users into entering login details on a fraudulent interface. No drainer kit artifacts were detected during static analysis, suggesting a lightweight credential-harvesting operation rather than a full-fledged crypto-drainer deployment. This domain resolves to IP 104.26.9.71 and is registered through NameCheap, Inc. on July 02, 2021. VirusTotal currently returns a clean score of 0/95 detections, and the SSL certificate is issued by Google Trust Services, likely to enhance perceived legitimacy. The domain remains unlisted on major blocklists, indicating a recently escalated campaign. Despite the absence of detections, the mismatch between the legitimate service’s infrastructure and this domain’s registration details underscores its malicious intent. The threat is currently active with an under-investigation status, reflecting ongoing forensic analysis. Users are advised to avoid accessing csgoempiremirror.com and verify site authenticity via official channels. Affected parties should rotate credentials and enable two-factor authentication on their CS:GO Empire accounts. Remaining risk is assessed as moderate, pending further intelligence on campaign scope and victimology.