# store.workshopvalvemods.com — SUSPICIOUS

> store.workshopvalvemods.com (0/95 VirusTotal detections) — identified as a crypto drainer impersonating Valve Workshop Mods. Avoid entering crypto wallets.

## Summary
PhishDestroy identifies store.workshopvalvemods.com as a suspected crypto drainer domain masquerading as the legitimate Valve Workshop Mods store. The site leverages a deceptive branding strategy to trick users into connecting cryptocurrency wallets under the false pretense of purchasing mods, with the malicious intent of draining digital assets.  

This domain was flagged due to its specific threat profile as a crypto drainer impersonation targeting Valve Workshop Mods users. Technical indicators confirm it resolves to IP 188.114.96.3 via Global Domain Group LLC, registered on April 02, 2026, and secured with a Let’s Encrypt SSL certificate. As of now, VirusTotal reports zero detections out of 95 engines, indicating it has evaded widespread automated detection systems.  

Currently, the domain remains active with a threat level marked as 'under investigation'. It has not been added to major blocklists or Google Safe Browsing at this time. While the risk is still being evaluated, users are strongly advised not to interact with the site or connect any crypto wallets. The lack of detections suggests this is a newly deployed threat, and vigilance is required to prevent financial loss.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-04-02 17:44:21
- Registrar: Global Domain Group LLC
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/store.workshopvalvemods.com
- PhishDestroy: https://phishdestroy.io/domain/store.workshopvalvemods.com/
- LLM endpoint: https://phishdestroy.io/domain/store.workshopvalvemods.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/store.workshopvalvemods.com/
Last updated: 2026-04-05