login[.]workshopcomingskin[.]com

This domain, login.workshopcomingskin.com, poses a significant threat to users by impersonating the popular gaming platform Steam. The site mimics the login interface of Steam to deceive users into providing their account credentials. This type of phishing attack can lead to unauthorized access to personal accounts, potential data breaches, and loss of sensitive information.

Our investigation reveals multiple indicators of compromise. The domain was created on December 27, 2025, and registered through Global Domain Group LLC. Despite its offline status, its infrastructure has been flagged by 16 out of 95 security vendors on VirusTotal, highlighting its malicious intent. The domain resolves to an IP associated with Cloudflare, Inc., and uses an SSL certificate issued by Google Trust Services, which might lend it false credibility. Furthermore, it has been blocked by security services such as PhishDestroy and PhishingDB.

If you have visited this domain, it is critical to take immediate action. Change your Steam password and any other accounts where you might use similar credentials. Monitor your accounts for unauthorized activity and report any suspicious incidents to the appropriate security teams. Additionally, ensure your system is scanned for malware and update your antivirus software to enhance protection against phishing attempts.