faceit[.]wokseason[.]com

On July 23, 2026, investigators recorded the domain faceit.wokseason.com as an active component of a gaming‑related impersonation campaign targeting Steam. The site resolves to the IPv4 address 185.184.123.56, which is registered to AS213877 U1 DIGITAL SERVICES LTD in the Netherlands. WHOIS data show the domain was created on 11 May 2025 and is registered through Web Commerce Communications Limited. The authoritative name servers are HOLD1.LUXHOST.ORG and HOLD2.LUXHOST.ORG, both typical of bulk‑hosting services. A TLS certificate identified as “R11” was observed for the domain, indicating that HTTPS was offered at the time of capture.

The HTTP response returned a page title of “Steam Community,” matching the declared brand target of Steam and confirming the intent to masquerade as an official Steam resource. The campaign has been classified as a gaming scam, consistent with the use of the Steam brand to lure victims into credential theft or fraudulent transactions. Multi‑engine scanning on VirusTotal recorded 14 positive detections out of 93 submitted security vendors, reflecting a moderate level of consensus among scanners that the domain is malicious. The domain is listed on at least one public security blocklist and is actively blocked by the PhishDestroy mitigation service. No additional public‑reporting platforms such as Google Safe Browsing or AlienVault OTX were referenced in the available data.

As of the reporting date, the domain is marked as offline, suggesting that the operators have taken the site down or are temporarily suspending activity. However, the underlying infrastructure – the hosting provider, name server configuration, and TLS certificate – remains unchanged and could be reused for future campaigns. Defenders should continue to monitor the IP address 185.184.123.56 and the associated ASN for any resurgence, update URL filtering rules to block the fully qualified domain name, and consider adding the domain to internal blocklists.