store[.]workshop-pistols[.]com

Analysis of store.workshop-pistols.com indicates a phishing domain targeting users of the Steam Workshop platform, as evidenced by the page title 'Steam Workshop::Balance | Glock-18'. The domain was created on February 21, 2026, and is currently offline. It resolved to IP address 172.67.189.168, hosted on Cloudflare's network (AS13335).

At the time of assessment, 14 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The domain's Gridinsoft trust score is 0/100, further supporting its classification as high-risk. The SSL certificate is classified as WE1, a low-trust category often associated with automated or short-lived certificates.

While the domain is no longer active, its infrastructure and detection history suggest it was used for credential harvesting or fraudulent transactions under the guise of Steam Workshop content. Defenders should treat any residual DNS or proxy logs referencing this domain as indicators of compromise and review associated network traffic for unauthorized access attempts. The absence of additional context regarding the phishing kit or victim interactions limits further attribution, but the domain's targeting of Steam users aligns with known patterns of gaming-related phishing campaigns.