login[.]workshopmodsaward[.]com

login.workshopmodsaward.com was registered on September 08, 2025 through Web Commerce Communications Limited. The domain is hosted on LuxHost infrastructure, using nameservers ns1.luxhost.org and ns2.luxhost.org, and resolves to the IPv4 address 94.74.164.47, which belongs to AS212238 (Datacamp Limited) and is geolocated in Germany. No TLS certificate is presented for the host, indicating that HTTPS is not available. The site’s sole visible HTML element is the page title “Anmelden”, which is German for “login”, but the content of the page has not been captured. The domain is currently taken offline, yet historical scans remain relevant.

Multiple security controls have flagged the domain. Google Safe Browsing classifies it as a social engineering threat, and Gridinsoft assigns a trust score of 0 / 100. VirusTotal recorded 17 detections out of 95 scanned engines, confirming its malicious reputation. The domain appears on one public blocklist and is specifically listed by PhishDestroy as a phishing source. The primary abuse vector is brand impersonation of “cs2”, a gaming‑related brand, and the operation is categorized as a gaming scam.

The lack of SSL and the use of a generic German‑language title suggest an attempt to lure victims into a credential‑stealing flow. Evidence points to a classic credential‑harvesting campaign targeting users of the cs2 brand, but the exact phishing landing page and payload have not been disclosed. Defenders should continue to block the domain at network perimeters, update URL filtering lists with the observed indicator set, and monitor for any re‑registration attempts of the same second‑level domain. Additional scrutiny of traffic to the associated IP range (94.74.164.0/24) is advisable, as the host may be reused for future campaigns. Continuous re‑evaluation is recommended because the offline status does not preclude re‑activation.