facepunch-new[.]org

facepunch-new.org was registered on February 21, 2026 and is currently offline. The site resolved to the IP address 104.21.95.89, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An SSL certificate identified as WE1 was present, indicating that HTTPS was enabled at the time of observation. The page title returned by the server was "Sign in," consistent with a credential‑phishing lure.

VirusTotal scans recorded six detections out of ninety‑three security vendors, confirming that multiple engines recognized malicious behavior. The domain appears on a single external security blocklist and is specifically listed by the PhishDestroy blocklist, demonstrating that at least one dedicated anti‑phishing service has taken action against it. The evidence points to a classic credential‑phishing campaign, targeting users who might be tricked into entering login details on a page titled "Sign in." While the domain is presently taken offline, the underlying hosting infrastructure (Cloudflare) can be re‑used for future campaigns, and the SSL certificate suggests the operator is capable of obtaining valid TLS certificates.

Defenders should add 104.21.95.89 to network‑level blocklists, enforce DNS filtering for facepunch-new.org, and monitor for any re‑registration or new subdomains on the same IP range. Security teams should also update endpoint protection rules to incorporate the six VirusTotal detections and ensure that any attempts to resolve the domain are logged and investigated. Continuous monitoring of Cloudflare‑hosted IP ranges for similar page titles or certificate patterns is advisable to pre‑empt potential re‑deployment of this phishing infrastructure.