store[.]poweredartwork[.]shop

The domain store.poweredartwork.shop was observed hosting a page titled “Steam Workshop::Toxic Affection | Warpaint,” indicating an attempt to masquerade as a Steam Workshop resource. The site was registered on October 19, 2025 through PublicDomainRegistry.com (operated by PDR Ltd.) and uses the regway.com name server set (dns1‑dns4.regway.com). It resolves to the IPv4 address 94.74.164.255, which is allocated to Datacamp Limited in Germany under ASN 212238. No TLS certificate was detected, so the service was reachable only over clear‑text HTTP. Gridinsoft assigned a trust score of 0 / 100, and VirusTotal recorded 14 of 95 scanning engines flagging the domain as malicious.

The domain appears on a single public blocklist and is actively blocked by PhishDestroy. As of the reporting date (July 23 2026) the host is taken offline, but historical DNS resolution remains visible. The combination of a non‑existent SSL certificate, low trust rating, multiple vendor detections, and the brand‑specific page title provides strong circumstantial evidence of a phishing operation targeting Steam users. However, because the site is no longer reachable, details of the payload, credential‑capture mechanism, or any secondary infrastructure cannot be confirmed at this time.

Defenders should continue to block the IPv4 address and the domain at perimeter filters, add the host to internal phishing‑responder lists, and monitor for future registrations that reuse the same name‑server pattern or ASN. Threat‑intel teams may also query passive DNS feeds for any historic CNAME or A‑record changes that could reveal additional drop points. Ongoing observation of the registrar’s batch registrations may uncover further malicious domains leveraging the same infrastructure. In summary, the observable indicators—registration data, hosting location, lack of TLS, low trust score, vendor detections, and the Steam‑related page title—justify an elevated risk rating and warrant proactive defensive measures.