faceitdota2[.]com

Analysis of the domain faceitdota2.com shows a short‑lived site that presented a page titled “GO VERIFY YOURSELF”. The domain was registered on 2 May 2026 through Web Commerce Communications Limited dba WebNic.cc and uses the nameservers ns1.eternitynames.net through ns4.eternityna. Hosting is on a server identified as Ubuntu with Apache HTTP Server, reachable at 31.76.120.146, an address allocated to EE Limited in the United Kingdom. A Let’s Encrypt certificate (E8) was in place at the time of capture, indicating HTTPS support. The site was flagged by three of ninety‑two VirusTotal scanners and is listed on one external blocklist; PhishDestroy also reported the domain as malicious.

Gridinsoft assigned a trust score of 0 / 100, reinforcing the low credibility of the host. The site has since been taken offline, and no further HTTP response is observed. Evidence confirms that the domain was used for a generic verification‑prompt phishing campaign, but the exact target brand or credential type is not disclosed beyond the generic page title. No additional indicators such as malicious payloads, redirects, or credential‑harvesting forms have been captured. Consequently, the full scope of the operation—whether it was a one‑off test or part of a broader campaign—is uncertain.

Defenders should block traffic to 31.76.120.146 and add faceitdota2.com to URL filtering lists. Monitoring of the associated nameserver domains and the registrar WebNic.cc for future registrations is advised. Organizations employing email or web gateway solutions should continue to rely on existing phishing detection feeds, as the domain already appears in multiple threat‑intelligence sources. Because the site is offline, any active exploitation is likely halted, but the infrastructure pattern (Ubuntu/Apache on a UK‑based IP with Let’s Encrypt) may reappear in new domains, so vigilance is recommended.