workshop-designer[.]shop

This domain, workshop-designer.shop, is actively flagged as a high-risk brand impersonation targeting Steam users. Analysis indicates the site presents itself as a Steam Workshop page, evidenced by the page title 'Steam Workshop::Balance | Glock-18,' which suggests an attempt to lure victims with promises of in-game weapon skins or modifications. The domain is hosted on Cloudflare infrastructure (AS13335) and resolves to IP 172.67.199.32, located in the US. It is currently blocked by at least one security vendor and appears in two AlienVault OTX threat intelligence pulses, reinforcing its malicious classification. Infrastructure analysis reveals the use of Cloudflare nameservers (izabella.ns.cloudflare.com, kaiser.ns.cloudflare.com) and technologies such as Cloudflare Browser Insights and HTTP/3, which are common among both legitimate and malicious sites but provide no inherent trust signal. The domain was registered through Dynadot Inc., though registration details beyond this are not available for further assessment. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing sites frequently use valid certificates to appear legitimate. Five of 91 security vendors on VirusTotal have flagged this domain, a detection rate consistent with emerging or evasive phishing campaigns. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, weapon-skin themed lures, and active blocking by security tools warrants immediate defensive action. Defenders should treat this domain as malicious, block resolution at the network level, and monitor for related indicators such as the IP address, nameservers, and SSL certificate issuer. Given its continued activity as of July 12, 2026, user education and endpoint protection measures are recommended to prevent engagement with this threat.