store[.]workshopvotedreview[.]com

This domain, store.workshopvotedreview.com, is an active phishing site designed to impersonate Facebook and deceive users into submitting their login credentials. The site presents a fraudulent interface mimicking Facebook’s authentication process, aiming to harvest sensitive account information such as usernames, passwords, and potentially two-factor authentication codes. The page title, 'Steam Workshop::Bounty Hunter's Brim,' is misleading and unrelated to Facebook, indicating an attempt to obfuscate the site’s true purpose while exploiting user trust in the targeted brand. Analysis indicates that the domain was registered on February 21, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious or high-risk domains. The site resolves to the IP address 188.114.97.3, hosted on Cloudflare’s infrastructure (AS13335), which is commonly used to mask the true origin of phishing campaigns. Detection metrics further confirm its malicious nature: 18 out of 95 security vendors on VirusTotal have flagged the domain, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites often employ valid certificates to appear legitimate. Users who have visited store.workshopvotedreview.com or entered credentials on the site should immediately take corrective action. First, change the password for the affected Facebook account and any other accounts sharing the same credentials. Enable multi-factor authentication if not already active. Monitor the account for unauthorized activity, such as unusual logins or messages sent without consent. If financial or personal data was entered, consider reporting the incident to relevant authorities and credit monitoring services. Avoid interacting with the domain or any links associated with it, and verify the legitimacy of any unexpected communications purporting to be from Facebook.