login[.]workshopskinsubscribe[.]com

The domain login.workshopskinsubscribe.com is suspected of engaging in brand impersonation targeting the Steam brand. No drainer kit has been identified in the analysis. The threat type is classified as brand impersonation, with an elevated risk level due to its impersonation of a well-known and widely used platform.

Infrastructure analysis reveals that login.workshopskinsubscribe.com has a VirusTotal score of 16/95, indicating a significant number of security vendors flag this domain as malicious. The domain is registered through Web Commerce Communications Limited and resolves to the IP address 172.67.165.62, which is located in the United States and is part of AS13335 Cloudflare, Inc. The domain was created on November 05, 2025. It appears on one security blocklist and is currently listed as blocked by PhishDestroy.

The domain is currently offline, which suggests that it has been taken down as part of a response action to mitigate the threat. Despite this, the historical data and the number of security vendors flagging the domain indicate a persistent risk. Users should exercise caution and avoid interacting with any similar domains or pages that may still be active, and report any suspicious activity to Steam or their security provider.