store[.]workshopsavemods[.]com

store.workshopsavemods.com is a subdomain of workshopsavemods.com. PhishDestroy first observed the hostname on Feb 26, 2026. Stored content metadata identifies Counter-strike as the apparent target. The captured page title is “Steam Workshop::AK47 | Fortune”. Page analysis recorded additional brand references to Cs2, Facebook, Reddit, Spark, Steam, Valve, and YouTube. Stored page analysis classifies the content as brand impersonation. Current evidence score: 86/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and URLScan. VirusTotal recorded 12 detections among 95 engines: ADMINUSLabs, BitDefender, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Kaspersky, Lionic, Phishing Database, SOCRadar, Sophos, Webroot on Jul 18, 2026 at 20:45 UTC. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Steam and assigned phishing as its category on Jul 29, 2026 at 02:50 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:31 UTC; content was unavailable. Registration records for the registrable domain workshopsavemods.com list Hello Internet Corp as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 91.92.46.57 on AS214196 (Vladylsav-Naumets Vladylsav Naumets, UA). The recorded endpoint location is Warsaw, PL. The stored server header is openresty. DOM analysis on Mar 23, 2026 at 23:12 UTC returned 15/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists E6 as the certificate issuer.

The content indicators and 2 positive source findings support the current Counter-strike-themed brand impersonation classification.