store[.]workshopcommunityrewards[.]com

The domain store.workshopcommunityrewards.com was registered on May 23, 2026 through Global Domain Group LLC and is currently active. It resolves to the Cloudflare‑owned address 188.114.97.3, with nameservers ezra.ns.cloudflare.com and khloe.ns.cloudflare.com, and presents a Let’s Encrypt/E7 TLS certificate. HTTP responses return status 521, indicating a Cloudflare‑origin error, while client‑side analysis shows the presence of YouTube embeds, React, Prototype, script.aculo.us, jQuery, and Cloudflare Browser Insights scripts. The page title "Steam Workshop::Chief Executor" and the declared brand target Steam identify the site as a brand‑impersonation campaign aimed at Steam users. Threat intelligence flags the domain as high‑risk; it appears on one security blocklist, is blocked by PhishDestroy, and received 15 positive detections out of 91 scanners on VirusTotal. The Gridinsoft trust score of 0 / 100 further underscores its malicious nature. Defenders should immediately block both the domain and its resolving IP, incorporate the observed script libraries into detection rules, and monitor for any related traffic to Cloudflare edge nodes. Continuous threat‑intel updates are advised to capture any future re‑hosting attempts or variations of the campaign.