store[.]communitymarketsdevs[.]com

This domain, store.communitymarketsdevs.com, is identified as a credential harvesting phishing site targeting Steam users. The page title, 'Stеаm Workshop::AWP | Ancient Heritage,' mimics legitimate Steam Workshop content to deceive users into entering login credentials. The use of homoglyphs in 'Stеаm' (Cyrillic 'е') indicates an attempt to bypass simple detection mechanisms and trick users into believing the site is authentic. Analysis suggests the domain was specifically crafted to exploit Steam's gaming community, likely distributing malware or stealing account credentials for resale or unauthorized access. Evidence supporting this assessment includes 13 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain was registered on October 10, 2025, through GRANSY S.R.O D/B/A SUBREG.CZ, a registrar frequently associated with phishing infrastructure. It resolves to the IP address 94.74.164.255, hosted on AS212238 (Datacamp Limited) in Germany. The domain appears on one security blocklist and is currently offline, though this status may change. The absence of an SSL certificate further indicates a lack of basic security measures, typical of low-effort phishing campaigns. Users who visited store.communitymarketsdevs.com should immediately change their Steam account credentials, especially if login details were entered. Enable multi-factor authentication (MFA) on all gaming and financial accounts to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized purchases or logins from unfamiliar locations. If malware exposure is suspected, perform a full system scan using updated security software. Report the incident to Steam support and consider notifying relevant cybersecurity organizations to aid in tracking the threat infrastructure.