workshopskinforge[.]com

This domain, workshopskinforge.com, is flagged as a brand impersonation threat targeting Steam users. Analysis indicates the site mimics Steam Workshop content, specifically presenting a fraudulent page titled 'Steam Workshop::AUG | Poseidon v1' to deceive victims into entering login credentials or downloading malicious files. The domain operates under the guise of a legitimate gaming asset platform, leveraging social engineering tactics to exploit users seeking mods or skins for Steam games. Infrastructure analysis reveals the domain was registered on November 14, 2025, through Web Commerce Communications Limited and resolves to the IP address 104.21.71.8, hosted on Cloudflare's network (AS13335). The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 17 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing sites. No Google Safe Browsing (GSB) hits are currently recorded, though this may reflect detection latency rather than absence of threat. The domain has been taken offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. The elevated risk level stems from the domain's recent creation, use of Cloudflare to obfuscate hosting, and prior detection by multiple security engines. Users are advised to verify Steam Workshop links via official channels, monitor for unauthorized account activity, and report any residual redirects or cached versions of the site to security teams for further mitigation.