login[.]workshopvoteshare[.]com

Analysis of login.workshopvoteshare.com indicates that the domain was registered on February 21, 2026 and is presently taken offline. The site presented the page title "Kirjaudu sisään" and was identified as a brand‑impersonation campaign targeting the cs2 brand. Technical evidence shows the domain resolves to the IP address 91.92.46.57, which is registered to AS41745 Baykov Ilya Sergeevich in Poland. The SSL certificate associated with the host is rated E5, and the Gridinsoft trust score for the domain is 0 out of 100, reflecting a complete lack of trust.

VirusTotal scans recorded 11 detections out of 93 security vendors, confirming that multiple scanning engines flagged the domain as malicious. The domain appears on a single security blocklist and has been specifically blocked by the PhishDestroy service. Risk is classified as elevated, and the overall status is offline, suggesting the operator may be preparing to reactivate the site or shift infrastructure.

Defenders should immediately add login.workshopvoteshare.com to DNS and URL deny lists, enforce blocking of its associated IP 91.92.46.57 at network perimeters, and monitor for any resurgence of activity. Continuous ingestion of threat‑intel feeds that reference this domain, its IP range, and the associated ASN is recommended to catch potential re‑use. Given the low trust score and the confirmed brand‑impersonation intent, security teams should also audit authentication logs for any attempted logins that reference the cs2 brand and consider user awareness training focused on the Finnish‑language page title "Kirjaudu sisään" to reduce successful credential harvesting.