steam[.]workshopviewinfo[.]com

Analysis of steam.workshopviewinfo.com indicates a deliberate attempt to impersonate the Steam brand through a gaming‑related fraudulent page. The domain was registered on 15 September 2025 via PDR Ltd. d/b/a PublicDomainRegistry.com and points to the IPv4 address 94.26.255.31, which is hosted by AS49505 JSC Selectel in Russia. Both authoritative nameservers, ns1.fastfox.pro and ns2.fastfox.pro, resolve to the same IP, suggesting a single‑point hosting arrangement. No TLS certificate is presented for the host, so any attempted connections would be unsecured HTTP only. The page title returned during the brief online presence was "Steam Workshop :: Wicked Rose," confirming a direct reference to the Steam Workshop service, consistent with the listed scam type of a gaming scam.

The domain has been blocked by the PhishDestroy platform and appears on one external security blocklist. Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating, reflecting a high confidence in malicious intent. VirusTotal reports that 10 of 95 scanning engines flagged the domain, reinforcing the suspicion despite the current offline status. No additional content or visual analysis is available because the site was taken down before a full forensic capture could be performed.

Defenders should immediately add steam.workshopviewinfo.com and its resolving IP address (94.26.255.31) to inbound and outbound deny lists at perimeter firewalls and proxy devices. Given the use of FastFox nameservers and a Russian hosting provider, monitoring for new subdomains under the same nameserver pair is advisable, as threat actors often replicate infrastructure across similar domains. Encourage endpoint security solutions to enforce Safe Browsing and to treat any requests to the domain as high‑risk, especially when users are accessing Steam‑related services.