store[.]poweredartstyle[.]com

store.poweredartstyle.com was registered on 29 October 2025 through Name SRS AB and assigned the four regway.com name servers (dns1‑dns4.regway.com). The domain resolves to 94.74.164.255, an address hosted in Germany and announced by AS212238 (Datacamp Limited). No TLS certificate is presented, indicating that the site operated only over HTTP. The page title observed during a single scrape was “Steam Workshop::AK47 | Psychedelic Faces”, which aligns with the listed scam type of a gaming‑related scheme.

The intelligence flags the domain as a brand‑impersonation campaign targeting Facebook, despite the page content referencing a Steam workshop item, suggesting the operators may have combined multiple lure vectors. Security‑vendor scans on VirusTotal reported 12 positive detections out of 95 scanners, and the domain appears on one public blocklist. Gridinsoft assigned a trust score of 0 / 100, and the site was flagged by the PhishDestroy blocklist before being taken offline. The lack of an SSL certificate, combined with the low trust rating and multiple vendor detections, provides strong technical evidence of malicious intent.

Uncertainty remains regarding the exact phishing flow, as no login pages or credential‑harvesting URLs have been captured. The brief existence (approximately nine months) and the offline status limit further behavioral analysis. Defenders should continue to block the domain at network perimeters, update URL filtering lists with the observed IP and name‑server identifiers, and monitor for any re‑registration attempts by the same registrar or host. Continuous observation of the ASN and related sub‑nets is recommended to detect potential migration of the campaign to new infrastructure.