login[.]workshopratemods[.]com

This domain, login.workshopratemods.com, is identified as a high-risk credential phishing site specifically targeting Counter-Strike 2 (CS2) users. Analysis indicates the site impersonates legitimate gaming authentication portals, likely designed to harvest login credentials or distribute malware under the guise of workshop modifications. The page title "サインイン" (Japanese for "Sign In") suggests a localized approach to increase credibility among targeted victims, though no drainer kit signatures have been confirmed at this time. Infrastructure analysis reveals the domain was registered on December 29, 2025, through Global Domain Group LLC, with no SSL certificate present. It resolves to the IP address 185.107.74.44, hosted on AS200430 (WEBO LLC) in Sweden. Google Safe Browsing flags the domain as phishing, and it appears on at least one security blocklist. VirusTotal reports 18 out of 95 security vendors detecting the domain as malicious, providing strong technical evidence of its fraudulent nature. The domain is currently offline, likely due to takedown actions or voluntary suspension. However, residual risk remains as the infrastructure (IP, registrar, or associated threat actors) may be reused for future campaigns. Organizations should monitor for re-registration attempts or shifts to new domains under the same registrar. Network defenders are advised to block the IP 185.107.74.44 and implement detection rules for domains registered through Global Domain Group LLC with similar naming patterns or targeting gaming communities. Users should verify authentication portals directly through official sources and report suspicious domains to relevant security teams.