store[.]workshopmodsaward[.]com

Analysis of the domain store.workshopmodsaward.com indicates a confirmed phishing campaign targeting users of the Counter-Strike franchise. The domain was registered on September 8, 2025, through Web Commerce Communications Limited, a registrar frequently associated with low-reputation domains. Infrastructure analysis reveals the site resolved to the IP address 94.74.164.47, hosted under AS212238 (Datacamp Limited) in Germany. No SSL certificate was detected, increasing the risk of unencrypted data interception for visitors.

The page title, 'Steam Workshop::MAC-10 | Poison Revenge [TOXIC]', explicitly references Steam Workshop, a platform for Counter-Strike modding and custom content, suggesting an attempt to deceive users seeking in-game modifications or skins. The domain appears on one security blocklist, and 17 of 95 security vendors on VirusTotal flagged it as malicious at the time of assessment. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The domain was taken offline following detection, though its prior hosting infrastructure remains a potential indicator for related campaigns.

Defenders should prioritize blocking the domain and its resolving IP (94.74.164.47) at the network level. Monitoring for similar domains registered via Web Commerce Communications Limited or resolving to AS212238 may aid in identifying related threats. Given the absence of SSL and the domain's explicit targeting of gaming communities, users should be educated on verifying official sources for Counter-Strike content to mitigate risk. The exact phishing kit or payload delivered by this domain is not yet analyzed, but the available evidence confirms its classification as a gaming scam.