steamcommunity[.]workshopitem[.]com

The domain steamcommunity.workshopitem.com was registered on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows that the domain resolves to the IPv4 address 94.26.255.20, which belongs to the Russian autonomous system AS49505 operated by JSC Selectel. The hosting location is therefore Russia. The site presented an SSL certificate identified as R12, indicating that a valid TLS layer was in place at the time of observation.

Threat intelligence flags the domain as a brand impersonation campaign targeting Steam, categorized as a gaming‑related scam. VirusTotal records indicate that 16 of 93 scanned security vendors flagged the domain as malicious, providing a moderate detection confidence across multiple independent scanners. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service, reinforcing its classification as hostile.

Risk assessment assigns an elevated level due to the combination of brand impersonation, the presence of a TLS certificate, and the multi‑vendor detection count. Defenders should consider adding the IP address 94.26.255.20 to network‑level deny lists, enforce DNS filtering for the domain, and monitor for any resurgence of the domain or related subdomains. Continuous observation of the associated autonomous system and any future registration activity linked to the same registrar is recommended to pre‑empt potential re‑use of the infrastructure.