faceit[.]idlobby[.]pro

Analysis of the domain faceit.idlobby.pro as of July 24, 2026 shows a clear pattern of brand impersonation targeting the CS2 community. The domain was registered on February 21, 2026 and resolves to the IP address 172.67.136.44, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented for the site is identified as "WE1," indicating that a valid SSL certificate is in place, but the certificate does not appear to be tied to the legitimate FACEIT brand. The HTTP service is currently offline, and the domain has been taken down, yet historical evidence remains relevant for defensive monitoring.

Two of ninety‑five security scanners on VirusTotal flagged the domain, reinforcing the suspicion that malicious activity was observed. Additionally, the domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming that at least one reputable anti‑phishing service recognized it as abusive. The Gridinsoft trust score is 0 out of 100, further underscoring the lack of credibility.

The page title returned by the server is "FACEIT.com," directly copying the official brand name, while the scam type is cataloged as "Brand Impersonation" and the target brand is listed as cs2. This combination of a legitimate‑sounding title, the use of the FACEIT trademark, and the specific reference to the CS2 game suggests an attempt to lure users seeking official FACEIT services for Counter‑Strike 2.

Uncertainties remain regarding the exact payload or credential‑harvesting mechanism, as no content analysis or screenshot data is available. No additional intelligence such as OTX indicators, Safe Browsing verdicts, or registrar details were provided. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the exact domain, and monitor for any resurgence of the host under new subdomains.