store[.]workshopvotecreated[.]com

The domain store.workshopvotecreated.com was created on February 21, 2026 and is presently marked as offline. DNS queries resolve the name to 109.120.137.137, an address located in Germany and assigned to AS215730 operated by H2NEXUS LTD. The hosting IP is referenced by a single security blocklist and the domain is actively blocked by the PhishDestroy mitigation service. Reputation scoring from Gridinsoft assigns a trust rating of 0 out of 100, indicating a severely untrusted profile.

VirusTotal analysis shows that 11 of 95 antivirus engines flag the domain, reinforcing the malicious assessment. The site presents an SSL certificate identified as type E7, suggesting a low‑grade or self‑signed certificate often associated with fraudulent infrastructure. The page title returned from the live endpoint, "Steam Workshop::Bounty Hunter's Brim," does not correspond to the claimed brand target, which is listed as Facebook.

This mismatch, combined with the classification as a Social Media Phishing campaign, points to an attempt to lure victims under the guise of Facebook‑related content while delivering unrelated or malicious payloads. Defenders should add the domain and its resolving IP to local deny lists, ensure that inbound traffic to the address is blocked, and monitor for any related indicators such as the SSL fingerprint or the distinctive page title. Because the site is already offline, continued observation of re‑registration attempts or similar naming patterns is advisable to pre‑empt potential resurgence.