login[.]workshopvotesharing[.]com

Analysis of the domain login.workshopvotesharing.com confirms its classification as a high-risk phishing site targeting Steam users, as documented on July 23, 2026. The domain was registered on December 24, 2025, through Global Domain Group LLC and currently resolves to the IP address 172.67.205.231, hosted on Cloudflare's infrastructure (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (algin.ns.cloudflare.com and penny.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which are common among both legitimate and malicious sites but provide no inherent security assurance. Detection metrics indicate moderate but growing awareness among security vendors: 15 of 93 engines on VirusTotal flag the domain as malicious, while it appears on at least one security blocklist, specifically PhishDestroy.

The domain's Gridinsoft trust score of 0/100 further supports its classification as a confirmed threat. The page title 'Sign In' and the scam type 'Gaming Scam' explicitly link the domain to Steam brand impersonation, aligning with the observed pattern of credential theft targeting gaming communities. The HTTP 301 status suggests the site may be redirecting visitors to another malicious endpoint, though the final destination remains unconfirmed.

While the domain's creation date predates the report by seven months, its continued activity and lack of widespread blocklist coverage indicate it may still be evading detection in some environments. Defenders are advised to block the domain and its resolving IP at the network level, monitor for related subdomains, and alert users to the Steam impersonation risk. Further investigation into the redirect chain and any associated infrastructure is recommended to identify additional compromised assets.