powereditemart[.]shop

The domain powereditemart.shop has been identified as a credential theft operation specifically targeting users of the Steam platform. Analysis indicates the site impersonates legitimate Steam Workshop content, presenting a fraudulent page titled 'Steam Workshop::Toxic Affection | Warpaint' to deceive victims into entering sensitive account credentials. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented threat. Infrastructure analysis reveals the domain was registered on October 18, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 94.74.164.255 and was flagged by 14 of 95 security vendors on VirusTotal, with detections spanning multiple threat intelligence sources. The domain appears on two security blocklists and has been referenced in 18 threat intelligence pulses on AlienVault OTX. Notably, the site operated without an SSL certificate, further increasing its risk profile for users. Current status confirms the domain is offline, though residual risk persists for users who may have interacted with it prior to takedown. Organizations and individuals are advised to block the domain and associated IP at the network level, reset credentials for any accounts accessed during potential exposure, and monitor for unauthorized activity. Users should verify the authenticity of Steam Workshop links through official channels and enable multi-factor authentication to mitigate credential theft risks.