store[.]powereditemdev[.]shop

Analysis of store.powereditemdev.shop indicates that the domain is currently offline. The domain was registered on October 10 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses the four nameservers dns1.regway.com through dns4.regway.com. DNS resolution points to the IPv4 address 94.74.164.255, which is allocated to AS212238 Datacamp Limited and geolocated in Germany. No TLS certificate is presented for the host, meaning HTTPS connections are not available. The page title retrieved before takedown was “Steam Workshop::Toxic Affection | Warpaint”, suggesting the site attempted to reference Steam Workshop content, but the content of the page has not been analyzed further.

The domain appears on a single public security blocklist and is listed as blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a highly untrusted classification. VirusTotal scans show that 13 of 95 antivirus and URL‑filtering engines flagged the domain as malicious, reinforcing the suspicion of phishing activity. The lack of an SSL certificate, the low trust score, and the presence on blocklists collectively point to a malicious infrastructure used for generic phishing. However, without live HTTP responses or content analysis, the exact phishing vector, credential‑harvesting method, and victim profile remain uncertain.

Defenders should continue to block the domain at perimeter firewalls and proxy filters, add the IP address 94.74.164.255 to deny‑list entries, and monitor for any future resolution to new hosts. Threat‑intel feeds that ingest blocklist entries, VirusTotal detections, and Gridinsoft scores should be updated to include this indicator. Continuous re‑resolution checks are recommended in case the domain is re‑registered or the hosting infrastructure is moved.