store[.]workshopcreatorsdesign[.]com

This domain, store.workshopcreatorsdesign.com, is actively engaged in brand impersonation targeting Counter-Strike, a widely recognized gaming franchise. The site mimics Steam Workshop content, specifically presenting a page titled 'Steam Workshop::Glock-18 | Carved arabesque,' designed to deceive users into believing they are accessing legitimate in-game modifications or community content. Such impersonation is commonly used to distribute malware, harvest login credentials, or trick users into downloading malicious files under the guise of game-related assets. The targeted nature of this threat increases the likelihood of successful compromise, particularly among gaming communities where trust in workshop-style content is high. Analysis indicates the domain was registered on February 21, 2026, through Global Domain Group LLC, and is hosted on infrastructure associated with Cloudflare, Inc. (AS13335) at IP address 188.114.97.3. The domain appears on two security blocklists and is flagged by 17 out of 95 security vendors on VirusTotal, reflecting elevated detection rates. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as encrypted connections are frequently exploited to lend false legitimacy to phishing sites. The combination of recent registration, brand impersonation, and Cloudflare hosting—commonly used to obscure malicious infrastructure—further corroborates the elevated risk assessment. Users who have visited store.workshopcreatorsdesign.com or interacted with its content should immediately terminate any active sessions and avoid downloading any files. Credentials entered on the site should be considered compromised; affected users must change passwords for associated accounts, particularly those linked to gaming platforms or payment services. System scans using updated security tools are recommended to detect potential malware infections. Network-level blocking of the domain and its resolving IP (188.114.97.3) is advised for organizations to prevent further exposure. Monitoring for unusual account activity or unauthorized transactions is critical in the aftermath of potential compromise.