login[.]workshopvotesbrowse[.]com

This domain was flagged on 24 July 2026 as a brand‑impersonation site targeting the cs2 brand. The fully qualified domain name login.workshopvotesbrowse.com resolves to the Cloudflare‑owned address 188.114.96.3, which is advertised as being located in the United States under ASN 13335 (Cloudflare, Inc.). The domain was registered on 21 February 2026 through Global Domain Group LLC and is serviced by the Cloudflare name servers ignacio.ns.cloudflare.com and nelci.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) is present, indicating a valid TLS handshake despite the malicious intent.

The HTTP response returned a 403 status code, and the site is currently taken offline. The page title observed during the brief scan was “Inloggen”, which aligns with the credential‑phishing classification. The infrastructure received a Gridinsoft trust score of 0 / 100, confirming a high‑risk rating. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service.

VirusTotal analysis shows that 16 of 93 scanning engines flagged the domain, reinforcing the suspicion of malicious activity. Evidence confirms that the site is designed to harvest credentials for the cs2 brand, but the exact content of the landing page has not been captured, leaving the visual phishing vector unknown. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP address, and consider adding the domain to internal blocklists. Ongoing observation of the Cloudflare‑hosted IP is advised, as the infrastructure could be repurposed for future campaigns.