store[.]itemsdetail[.]com

The domain store.itemsdetail.com was registered on 12 December 2025 through NiceNIC International Group Co., Limited. Its authoritative name servers are dave.ns.cloudflare.com and wren.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. DNS resolution points to the IPv4 address 192.142.10.5, which is hosted in the Netherlands under AS214036 (Ultahost, Inc.). No TLS certificate is presented for the host, meaning traffic is served over plain HTTP only. The site was taken offline before the analysis date of 25 July 2026, and its current HTTP status is unavailable.

VirusTotal records show that nine out of ninety‑three scanning engines flagged the domain as malicious, and the Gridinsoft trust score is 0 / 100, reflecting a highly suspicious reputation. PhishDestroy lists the domain as blocked, and it appears on a single external security blocklist. The page title returned by the server is “Steam Workshop::Authority Figure”, which suggests an attempt to lure victims by referencing the Steam Workshop brand, although the actual page content has not been captured. The observable evidence points to a generic phishing operation that likely targeted users of the Steam platform. The combination of a recent registration, Cloudflare DNS, a low‑reputation IP, absence of encryption, multiple vendor detections, and blocklist inclusion supports this conclusion.

Uncertainty remains regarding the specific credential‑capture mechanism, the exact content delivered to victims, and any additional infrastructure that may have been used. Defenders should add 192.142.10.5 to network‑level deny lists, block store.itemsdetail.com at DNS and URL filtering layers, and monitor for any future re‑registration of the domain or similar domains using the same registrar or hosting provider. Continuous telemetry from threat‑intel feeds that reference the nine VirusTotal detections can help surface related campaigns early.