faceit[.]premseason[.]com

The domain faceit.premseason.com was created on February 21, 2026 and continues to resolve to the IPv4 address 104.17.159.184. When accessed, the server returns an HTTP 403 status code and the page title is reported as “FACEIT.com”, suggesting an attempt to masquerade as the legitimate FACEIT brand. The campaign is classified as a cryptocurrency‑focused brand impersonation and is assigned a high‑risk rating.

Infrastructure analysis indicates that the IP belongs to AS13335, owned by Cloudflare, Inc., and is geolocated in the United States. The domain’s DNS is managed by two authoritative nameservers, dns‑expire1.matbao.com and dns‑expire2.matbao.com, both registered under MAT BAO CORPORATION. The SSL certificate associated with the site is identified as WE1, though detailed certificate parameters are not publicly disclosed.

Threat intelligence signals reinforce the malicious nature of the domain: VirusTotal records 4 positive detections out of 95 scanned security vendors, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and is already blocked by the PhishDestroy service. These indicators, together with the high‑risk classification and the cryptocurrency scam type, confirm that the infrastructure is actively being leveraged for malicious purposes.

Defenders are advised to block faceit.premseason.com at DNS resolvers, firewalls, and web‑proxy filters, and to consider blacklisting the associated IP address 104.17.159.184. Continuous monitoring of the two MAT BAO nameservers for additional sub‑domains that resolve to the same Cloudflare edge may uncover further elements of the campaign. Organizations should also reinforce user awareness campaigns that emphasize verification of URLs and caution against unsolicited cryptocurrency requests originating from domains that imitate well‑known brands.