facecelt[.]com

The domain facecelt.com has been identified as a credential theft phishing operation targeting user login credentials. Analysis indicates the domain is currently offline, though it previously hosted infrastructure designed to harvest authentication details through deceptive login portals. No specific brand impersonation has been confirmed, but the domain exhibits characteristics consistent with credential harvesting campaigns, including the use of obfuscated landing pages and redirect chains. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an atypical future date suggesting potential registration irregularities or data manipulation. The domain resolved to the IP address 104.21.19.235, a Cloudflare-associated endpoint commonly leveraged to mask origin servers in phishing campaigns. Detection metrics show 4 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The registrar, NICENIC INTERNATIONAL GROUP CO., LIMITED, has been previously associated with high volumes of abuse reports, further elevating the domain's risk profile. Current status indicates the domain has been taken offline, likely following abuse reports or automated takedown procedures. However, the infrastructure remains a latent threat due to the future-dated registration, which may allow for reactivation. Organizations are advised to proactively block the domain and its associated IP (104.21.19.235) at the network perimeter. End users should be trained to recognize credential theft tactics, particularly unsolicited login prompts or requests for sensitive information. Security teams are recommended to monitor for related domains registered under the same registrar, as this entity has demonstrated a pattern of facilitating malicious infrastructure.