store[.]workshop-glock18[.]cc

This domain, store.workshop-glock18.cc, is identified as a brand impersonation threat specifically targeting Counter-Strike community members. The site mimics the Steam Workshop interface, presenting a page titled 'Steam Workshop::Balance | Glock-18,' likely designed to deceive users into entering credentials or downloading malicious content under the guise of a legitimate in-game item or modification. The threat is tailored to exploit trust in the Counter-Strike brand, potentially leading to account compromise or unauthorized access to linked services. Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 185.214.74.170, hosted in the Netherlands under AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP). The domain currently holds no SSL certificate, increasing the risk of data interception. It appears on two security blocklists and is flagged by 19 out of 95 security vendors on VirusTotal, confirming its malicious classification. Infrastructure review reveals the domain is now offline, though its prior activity remains a concern for users who may have interacted with it. Users who visited store.workshop-glock18.cc should immediately revoke any credentials entered on the site and enable multi-factor authentication on associated accounts. Monitor linked accounts for unauthorized transactions or changes, particularly those tied to Steam or Counter-Strike. If any downloads were initiated from the domain, perform a full system scan using updated security tools to detect potential malware. Report the incident to relevant platform security teams to aid in broader mitigation efforts.