faceit[.]zeropointcs[.]com

Analysis of the domain faceit.zeropointcs.com indicates a credential-phishing campaign targeting users of the FACEIT gaming platform. The domain was registered on February 21, 2026, through Web Commerce Communications Limited (WebNic.cc), a registrar frequently observed in phishing infrastructure. At the time of assessment, the domain resolved to the IPv6 address 2a00:b700:5:100::100, hosted on AS51659 (LLC Baxet) in Russia. Nameservers ns100.webnic.cc and ns101.webnic.cc were assigned, consistent with registrar-provided DNS services.

The page title, 'FACEIT,' suggests an attempt to impersonate the legitimate FACEIT platform, though the exact content and functionality of the site remain unconfirmed. No active detections were recorded by the 93 vendors on VirusTotal at the time of scanning, though this absence does not confirm benign status. The domain appears on one security blocklist and was proactively blocked by PhishDestroy, indicating prior suspicion. The SSL certificate, classified as E6, may reflect a low-trust or automated issuance pattern commonly associated with malicious domains.

Infrastructure analysis reveals the domain was taken offline by July 23, 2026, though historical resolution and registration data remain relevant for retrospective threat hunting. Defenders should monitor for re-registration or reuse of the same IP, ASN, or registrar in future campaigns. Given the targeting of FACEIT credentials, organizations handling gaming-related authentication should review logs for connections to this domain prior to its takedown. Further investigation is required to determine the scale of compromise, distribution vectors, and potential credential harvesting mechanisms employed.