login[.]workshopartisthub[.]com

Analysis of login.workshopartisthub.com confirms that the domain is being used for credential phishing targeting the cs2 brand. The domain was registered on December 5, 2025 through MAT BAO CORPORATION and has since been taken offline, but forensic records indicate that it resolved to the IP address 172.67.180.151, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Hosting was provided via Cloudflare's DNS service, as evidenced by the authoritative nameservers heidi.ns.cloudflare.com and rob.ns.cloudflare.com. No TLS certificate was observed for the site, implying that any HTTP connections would have been unencrypted.

The page title returned by the server matched the domain name exactly, "login.workshopartisthub.com," and no additional content has been publicly disclosed. The domain appears on a single security blocklist, PhishDestroy, confirming that at least one threat‑intelligence provider has flagged it as malicious. VirusTotal scans reported 12 detections out of 93 security vendors, providing independent corroboration of its malicious nature. The primary threat classification is credential phishing, with the impersonated brand explicitly identified as cs2.

Uncertainties remain regarding the specific phishing kit employed and any post‑compromise payload that might have been delivered, as these details have not been captured in the available intelligence. Defensive recommendations include adding the domain and its associated IP address to network deny lists, updating web‑gateway and email filters to block content referencing the domain, and monitoring for similar registration patterns from MAT BAO CORPORATION or Cloudflare‑hosted infrastructure that target the cs2 brand. Continuous threat‑intel feeds should be consulted for any reappearance of the domain or related indicators of compromise.