login[.]workshopartistcontent[.]com

PhishDestroy has identified www.login.workshopartistcontent.com as a confirmed phishing site that specifically targets users of the cs2 platform by impersonating its login page. The domain is currently offline, having been taken down after security researchers flagged its malicious activity. This brand impersonation threat is designed to steal login credentials from unsuspecting victims who believe they are accessing a legitimate cs2 service.

Technical analysis reveals that the domain was created on February 21, 2026, and resolves to the IP address 94.141.122.69. It is flagged by 13 out of 95 security vendors on VirusTotal, indicating a significant consensus among security solutions regarding its malicious nature. Additionally, the domain appears on one security blocklist, and its SSL certificate is classified as R12. The page title observed was "Kirjaudu sisään," which is Finnish for "Log in," further confirming its phishing intent. Trust scores for this domain are extremely low due to these indicators.

As the domain is now offline, the immediate risk of credential theft is mitigated, but users should remain vigilant against similar phishing attempts. PhishDestroy recommends that all users verify the authenticity of any login pages by checking the official domain of the service they intend to use. If you have already entered credentials on this site, change your passwords immediately and enable two-factor authentication on your accounts. Always double-check URLs before entering sensitive information, and report any suspicious domains to security platforms like PhishDestroy.