login[.]workshopmodscreators[.]com

This domain, login.workshopmodscreators.com, operates as a credential theft site impersonating the CS2 (Counter-Strike 2) brand, specifically targeting users of the Steam Workshop platform. The fraudulent page presents a login interface titled 'Kirjaudu sisään' (Finnish for 'Log in'), designed to harvest Steam credentials under the guise of accessing workshop modifications. Analysis indicates the site is engineered to mimic legitimate Steam login portals, leveraging social engineering tactics to deceive users into submitting sensitive account information. Technical evidence confirms the malicious nature of this domain. As of the latest scan, 18 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while Google Safe Browsing explicitly classifies it as a phishing site. The domain appears on two independent security blocklists and is actively blocked by multiple threat intelligence feeds. Infrastructure analysis reveals the domain was registered on December 27, 2025, through Global Domain Group LLC, an uncommon registrar for legitimate gaming-related services. The site resolves to IP address 172.67.175.108, hosted on Cloudflare's network (AS13335), which is frequently abused by threat actors to obscure server origins. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security to potential victims. Users who have visited this domain or entered credentials should take immediate action to mitigate risk. First, change Steam account passwords using a secure device and enable multi-factor authentication if not already active. Monitor the account for unauthorized activity, including changes to workshop content, friend list modifications, or purchases. Check connected devices and revoke access for any unfamiliar sessions. Given the domain's registration date and active status, users should remain vigilant for similar phishing attempts targeting gaming communities. Organizations maintaining security blocklists should add this domain and its associated IP to their deny lists to prevent further exposure.