store[.]workshopskinsubscribe[.]com

Analysis of the domain store.workshopskinsubscribe.com indicates a brand‑impersonation campaign targeting the Counter‑Strike community. The domain was registered on 5 November 2025 through Web Commerce Communications Limited and resolves to the IPv6 address 2606:4700:3030::6815:49b6, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Both authoritative name servers, lara.ns.cloudflare.com and sam.ns.cloudflare.com, are Cloudflare‑provided, confirming the use of the provider’s DNS infrastructure. No SSL certificate is presented for the site, and the service is currently reported as offline, preventing retrieval of HTTP status codes or page content beyond the observed page title “Steam Workshop::AUG | Poseidon v1”.

The page title suggests a gaming‑related lure, consistent with the classified scam type “Gaming Scam” and the declared brand target “counter‑strike”. Reputation signals are strongly negative. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records twelve detections out of ninety‑five scanned engines, indicating that a minority of AV products have identified malicious behavior. The domain appears on a single public blocklist and is explicitly blocked by PhishDestroy, providing additional defensive coverage.

The combination of a newly created domain, Cloudflare hosting, lack of TLS, and the observed page title points to a short‑lived infrastructure designed to mimic legitimate Steam Workshop content and harvest credentials or deliver malware to users seeking Counter‑Strike assets. Uncertainty remains regarding the exact payload or credential‑harvesting mechanism because the site is offline and no further forensic artefacts have been captured.