login[.]workshopartstudio[.]com

This domain, login.workshopartstudio.com, was observed hosting a gaming‑related brand‑impersonation campaign targeting the cs2 brand. The site returned the page title “Anmelden” and was served without an SSL certificate, indicating an insecure HTTP service. Registration data show the domain was created on 2025-11-07 and is registered through Web Commerce Communications Limited. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain’s authoritative nameservers are alfred.ns.cloudflare.com and christina.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

VirusTotal scans recorded 14 detections out of 95 security vendors, corroborating malicious intent. The domain is listed on a single public blocklist, PhishDestroy, and has a Gridinsoft trust score of 0/100, further indicating a high confidence of abuse. No TLS certificate was present, which may hinder automated safe‑browsing checks but also makes the site easier to host on free infrastructure. The current operational status is “offline,” suggesting the site has been taken down or is temporarily unavailable. Evidence gaps remain regarding the specific phishing kit or payload delivered, as the page content beyond the title has not been publicly disclosed.

Additionally, the exact mechanisms used to lure victims (e.g., credential harvesting forms) are unknown. Defenders should continue to block the domain at perimeter filters, add the IP address 188.114.97.3 to deny‑list rules, and monitor for any re‑registration or resurrection of the same host name. Threat‑intel feeds should be updated to reflect the association with the cs2 brand and the gaming‑scam classification. Ongoing observation of Cloudflare‑hosted infrastructure is recommended, as attackers frequently rotate sub‑domains while retaining the same CDN edge IP range.