login[.]workshopconceptdesign[.]com

The domain login.workshopconceptdesign.com was registered on 24 January 2026 through Global Domain Group LLC. The authoritative nameservers darl.ns.cloudflare.com and leanna.ns.cloudflare.com indicate that the domain is front‑ended by Cloudflare’s network (AS13335, United States). DNS resolution points to the IP address 188.114.97.3, which is owned by Cloudflare and serves HTTP/3 traffic. The site presents a page title of “Sign In”, consistent with the reported brand impersonation of Steam, and is classified as a gaming‑related scam. An SSL certificate issued by Google Trust Services (common name WE1) is in place, but the HTTP response code is 403, suggesting access restrictions or deliberate content blocking.

Security telemetry shows that 16 of 93 vendors on VirusTotal have flagged the domain, and the domain appears on one external blocklist. It has been added to the PhishDestroy blocklist, and the Gridinsoft trust score is 0 out of 100, indicating a high confidence of malicious intent. The overall risk rating is high and the campaign remains active as of the report date, 23 July 2026. Current intelligence does not reveal the exact payload or credential‑harvesting mechanisms beyond the generic “Sign In” title; therefore the full malicious functionality cannot be confirmed.

Defenders should block the domain at perimeter firewalls and DNS resolvers, add the IP address 188.114.97.3 to network deny lists, and ensure that any inbound traffic to Cloudflare‑served hosts is inspected for anomalous authentication attempts targeting Steam accounts. Continuous monitoring of the associated ASN and related Cloudflare‑hosted subdomains is advised, as threat actors frequently reuse infrastructure. Updating endpoint detection signatures with the observed VirusTotal detections and incorporating the domain into threat‑intel feeds will reduce exposure to this active impersonation campaign.