login[.]workshopmodsrating[.]com

This domain, login.workshopmodsrating.com, operates as a fraudulent login portal impersonating the official CS2 platform. The site presents a Spanish-language login interface titled 'Iniciar sesión,' designed to harvest credentials from unsuspecting users attempting to access Counter-Strike 2 modding or workshop content. Analysis indicates the site functions as a classic brand impersonation scheme, likely aiming to compromise accounts for subsequent unauthorized access, in-game item theft, or distribution of malicious workshop content under the guise of legitimate CS2 services.

Technical evidence confirms the domain's malicious nature through multiple indicators. The domain is flagged by 21 out of 95 security vendors on VirusTotal, including explicit phishing classifications from Google Safe Browsing. Infrastructure analysis reveals registration through Global Domain Group LLC on December 22, 2025, an unusually future-dated creation that may indicate domain generation algorithm abuse or registrar manipulation. The site appears on two security blocklists (PhishDestroy and PhishingDB) and resolves to 188.114.97.3, a Cloudflare IP address (AS13335) commonly exploited for bulletproof hosting of phishing infrastructure. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while facilitating encrypted credential theft.

Users who have visited this domain should immediately take corrective action. Any entered credentials must be changed from a secure device, with priority given to the associated CS2 account and any linked email addresses. Enable multi-factor authentication on all gaming and financial accounts, and monitor for unauthorized workshop modifications or in-game transactions. The domain's future-dated registration suggests potential ongoing abuse; users should report the site to Steam support and consider submitting samples to additional threat intelligence platforms to improve detection coverage. System scans for malware are recommended, particularly if any downloads were initiated from the fraudulent portal.