login[.]workshopskingallery[.]com

Analysis of the domain login.workshopskingallery.com indicates it was actively involved in a brand impersonation campaign targeting users of the CS2 platform, as documented on July 23, 2026. The domain was registered on February 21, 2026, through Global Domain Group LLC, a registrar frequently associated with phishing infrastructure. Infrastructure analysis reveals the domain resolved to the IP address 188.114.97.3, which is part of AS13335, operated by Cloudflare, Inc., based in the United States. This hosting pattern is consistent with threat actors leveraging Cloudflare services to obscure the origin of malicious content and evade detection. The page title 'Zaloguj się' suggests the phishing site was localized for Polish-speaking users, though the exact content and mechanics of the scam remain unconfirmed due to the domain's current offline status.

The domain was flagged by 14 of 93 security vendors on VirusTotal, indicating moderate detection coverage at the time of scanning. Additionally, it appeared on at least one security blocklist, further corroborating its malicious classification. Gridinsoft assigned the domain a trust score of 0 out of 100, reflecting a high-risk assessment based on its infrastructure and behavioral indicators. The SSL certificate associated with the domain was issued by WE1, a provider commonly used in both legitimate and malicious contexts, offering no definitive signal of intent.

The domain's current offline status suggests it may have been taken down following detection or as part of a broader mitigation effort by hosting providers or security teams. Defenders are advised to treat this domain as compromised and include it in blocklists for both web and email filtering systems. Organizations should also monitor for related infrastructure, such as domains registered through the same registrar or resolving to the same IP range, as threat actors often reuse hosting providers and registration patterns across campaigns.