faceit-clubs-verify[.]com

The domain faceit-clubs-verify.com is currently engaged in a credential phishing campaign targeting users of the FACEIT gaming platform. Analysis indicates this domain is designed to harvest login credentials by impersonating an official account verification process. The domain remains active as of the latest assessment, with no indications of takedown or mitigation. Infrastructure analysis reveals the domain was registered on April 4, 2024, through Realtime Register B.V. It resolves to the IP address 172.67.128.54, which is associated with a content delivery network. The domain is flagged by 8 of 95 security vendors on VirusTotal, and it appears on two distinct security blocklists. Additional technical indicators include a Scamadviser trust score of 1/100 and a Gridinsoft trust score of 0/100. The SSL certificate is issued by Let's Encrypt, and the page title explicitly states 'GO VERIFY YOURSELF,' reinforcing its fraudulent intent. Detected technologies include Cloudflare and HTTP/3, suggesting the use of modern web infrastructure to evade detection. The risk level for this domain is classified as elevated due to its active status, low trust scores, and direct targeting of user credentials. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator of compromise. Users who may have interacted with the domain should immediately reset their FACEIT account credentials and enable multi-factor authentication where available. Continuous monitoring of related infrastructure is recommended, as threat actors frequently rotate domains and IPs to sustain phishing operations.