store[.]workspacepoweredart[.]com

This domain, store.workspacepoweredart.com, is actively flagged as a Google phishing threat. Analysis indicates the domain was registered on February 21, 2026, through a registrar based in Russia, though it currently resolves to Cloudflare infrastructure in the United States under AS13335. The domain returns an HTTP 200 status, yet its page title displays a Russian message indicating the domain is not linked to any hosting service, suggesting either a placeholder or an attempt to obscure its true purpose. Security vendors have detected malicious activity, with 15 out of 95 engines on VirusTotal flagging the domain, and it appears on one security blocklist. Infrastructure analysis reveals the domain employs Cloudflare nameservers and is secured with an SSL certificate issued by Google Trust Services, specifically the WE1 intermediate. The presence of HSTS and HTTP/3 further aligns with modern phishing tactics that leverage legitimate services to evade detection. While the domain is not currently serving overtly malicious content, the combination of its registration details, hosting provider, and security flags strongly suggests it is part of a phishing campaign targeting Google-related credentials or services. Defenders should treat this domain as high-risk. The use of Cloudflare complicates traditional IP-based blocking, but the domain’s nameservers and SSL certificate details provide actionable indicators for network-level filtering. Monitoring for connections to 2606:4700:3035::ac43:ac4d or domains resolving to the same infrastructure may help identify related threats. Given its recent creation and active status, this domain should be prioritized for inclusion in blocklists and endpoint protection rules, particularly in environments where Google services are in use.