faceitverlfy[.]com

PhishDestroy analysts have identified faceitverlfy.com as a live credential theft site actively impersonating the FACEIT brand. The domain presents a fraudulent login page titled 'GO VERIFY YOURSELF,' tricking users into surrendering their FACEIT account credentials. Unlike generic phishing pages, this site is engineered to harvest usernames and passwords for subsequent account takeover or sale on dark web marketplaces. The page mimics FACEIT's branding and login interface, exploiting user trust to maximize credential yield before discovery and takedown.

Technical analysis reveals alarming indicators: only 1 out of 95 VirusTotal security vendors currently detects this domain as malicious, highlighting evasion tactics. The domain was registered through Web Commerce Communications Limited (WebNic.cc) on March 31, 2026, and resolves to IP 188.114.96.3. The site utilizes a legitimate Let's Encrypt SSL certificate to appear trustworthy, further deceiving security tools and users. Despite its recent creation, this domain remains active and has not yet been flagged by Google Safe Browsing (GSB).

As of this report, faceitverlfy.com remains active and poses an elevated risk to FACEIT users. Immediate action is required: block the domain at DNS/network levels, blacklist the IP (188.114.96.3), and update corporate firewall rules. Users should treat any unsolicited FACEIT verification requests as suspicious and verify via the official FACEIT website or app. While takedown requests have been initiated, the domain's fresh registration and low VT detection rate suggest persistence. Users are strongly encouraged to enable two-factor authentication on their FACEIT accounts as a secondary defense. Remaining risk is high due to active status and low detection rate.