store[.]workshopartistcontent[.]com

The domain www.store.workshopartistcontent.com was registered on February 21, 2026 and is presently taken offline, but historical evidence shows it was used for a crypto‑draining operation that impersonated the Counter‑Strike brand. The site resolved to the IPv4 address 94.141.122.69, which is allocated to AS205775 (NEON CORE NETWORK LLC) in Finland. An SSL certificate identified as R12 was presented, indicating a low‑trust certificate that is typical of malicious infrastructure. The page title returned by the server, "Steam Workshop::Glock-18 | Carved arabesque," directly references a Steam Workshop item, confirming the intent to mimic official Valve content and lure users familiar with the Counter‑Strike ecosystem.

Threat intelligence feeds have recorded the domain on a single security blocklist and it has been actively blocked by the PhishDestroy service. Reputation scoring from Gridinsoft rates the domain at 0 / 100, reflecting an absence of trust. VirusTotal analysis shows that 12 of 93 scanning engines flagged the domain, reinforcing the suspicion of malicious activity.

The elevated risk rating aligns with the observed crypto‑scam behavior and brand impersonation. While the site is no longer reachable, defenders should continue to monitor the associated IP range for re‑use, enforce DNS‑level blocks for the domain and any sub‑domains, and update endpoint and web‑filter policies to reject traffic to the identified IP. Additional surveillance of newly registered domains that reference Steam Workshop terminology or Counter‑Strike assets is advised, as the pattern suggests a broader campaign that may resurface under new domains.