login[.]workshopvotescreate[.]com

This domain, login.workshopvotescreate.com, is flagged as an active brand impersonation threat targeting users of the CS2 gaming platform. Analysis indicates the site presents a fraudulent login interface, as evidenced by the page title 'Anmelden' (German for 'Log In'), suggesting an attempt to harvest credentials from unsuspecting victims. No direct evidence of a crypto drainer kit is present, but the domain’s structure and targeting align with credential theft campaigns commonly deployed in gaming-related phishing operations. Infrastructure analysis reveals the domain was registered on November 8, 2025, through Web Commerce Communications Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.95.108, which is proxied through Cloudflare, a service often leveraged to obfuscate malicious infrastructure. Detection metrics indicate the domain is flagged by 15 out of 95 security vendors on VirusTotal, while only appearing on a single blocklist. The SSL certificate is issued by Google Trust Services, further masking its malicious intent behind legitimate encryption protocols. Technologies detected include HTTP/3, which may be used to evade traditional network-based detection mechanisms. As of the latest assessment, the domain remains active and poses an elevated risk to users, particularly those within the CS2 community. The use of Cloudflare and a recently registered domain suggests an attempt to evade takedown efforts while maintaining operational persistence. Users are advised to avoid interacting with the domain, and network administrators should implement blocking measures at the DNS or IP level. Given the domain’s low blocklist prevalence and moderate detection rate, continued monitoring is recommended to assess potential shifts in its infrastructure or targeting tactics. The presence of a German-language login page may indicate a regional focus, warranting heightened vigilance among German-speaking users.