store[.]workshopvotepatern[.]com

The domain store.workshopvotepatern.com was registered on November 06, 2025 through Web Commerce Communications Limited and is currently taken offline. Infrastructure analysis shows the domain resolves to the IP address 104.102.49.106, which belongs to AS16625 Akamai Technologies, Inc. and is geolocated in Germany. The domain is served by Cloudflare authoritative nameservers sergi.ns.cloudflare.com and tani.ns.cloudflare.com, indicating the use of a reputable DNS provider to obscure the true hosting environment. No SSL certificate is present, meaning any web traffic would be delivered over unencrypted HTTP, a characteristic often observed in malicious delivery sites.

Reputation checks reveal a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. VirusTotal scans report that 12 of 95 anti‑malware engines flag the domain, providing independent confirmation of malicious intent. The site has been blocked by the PhishDestroy service, further supporting the assessment that it is being used for abusive purposes. The page title returned by the live host, "Steam Workshop::AUG | Poseidon v1," references the Steam Workshop and the Counter‑Strike brand, matching the declared impersonation target.

This suggests the domain was likely crafted to lure users interested in Counter‑Strike content, possibly to harvest credentials or deliver unwanted payloads. While the site is presently offline, the combination of recent registration, use of high‑profile DNS services, lack of encryption, low trust score, multiple vendor detections, and brand‑specific page title provides a strong indicator of a brand‑impersonation campaign. Defenders should ensure the IP address 104.102.49.106 is added to network‑level blocklists, monitor for any resurgence of the domain or similar patterns, and enforce strict outbound traffic controls to unencrypted HTTP destinations.