store[.]workshopbrowsemods[.]com

The domain store.workshopbrowsemods.com was registered on January 07 2026 through Global Domain Group LLC. The site is protected by Cloudflare and resolves to the nameservers aida.ns.cloudflare.com and clyde.ns.cloudflare.com. An SSL certificate identified as WE1 is present, and an HTTP response of 403 is returned when the root URL is accessed, while the page title reported by the scanner reads “Success!”. VirusTotal analysis shows that 16 of 95 scanned security vendors flagged the domain as malicious, indicating a measurable detection rate across multiple engines. The domain is currently listed on one public blocklist and has been blocked by the PhishDestroy feed, confirming that threat‑intel communities consider it active and hostile. The combination of a recently created domain, Cloudflare front‑end, and a 403 status coupled with a misleading page title suggests a typical phishing infrastructure designed to obscure the underlying credential‑harvesting page. However, the exact payload, target brand, or phishing kit employed remains unknown because no malicious content was retrieved during the scan. Defenders should add store.workshopbrowsemods.com to URL filtering and sink‑hole rules, ensure that any outbound traffic to the domain is blocked, and monitor for similar Cloudflare‑protected domains registered after early 2026 that exhibit a 403 response with deceptive titles. Continuous re‑scanning is advised to capture any future changes in the site’s behavior or content.