login[.]workshopmodreview[.]com

The domain login.workshopmodreview.com is currently flagged as an active phishing site specializing in brand impersonation targeting CS2 (Counter-Strike 2) users. Analysis confirms the domain is designed to harvest account credentials through fraudulent login portals, with the page title displayed as サインイン (Japanese for 'Sign in'), suggesting a targeted approach toward specific user demographics. Infrastructure analysis reveals the domain was registered on December 30, 2025, through Global Domain Group LLC, an unusually future-dated creation that may indicate an attempt to evade detection through temporal anomalies. It resolves to the IP address 172.67.187.11, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is flagged by 18 of 95 security vendors on VirusTotal, with active listings on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate in origin, is commonly exploited in phishing campaigns to lend false credibility to malicious sites. Current threat assessment indicates an elevated risk due to the domain's active status, confirmed credential harvesting intent, and use of content delivery network infrastructure to obscure hosting origins. Organizations and users are advised to block the domain and associated IP address at the network perimeter. Endpoint protection systems should be updated to include this domain in deny lists. Users who may have interacted with the site should immediately reset their CS2 account credentials via official channels and enable multi-factor authentication where available. Monitoring for unauthorized access or modifications to linked accounts is strongly recommended.