tw-faceit[.]com

The domain tw-faceit.com has been identified as a credential theft operation specifically targeting users of the FACEIT gaming platform. Analysis indicates this infrastructure was designed to impersonate legitimate FACEIT services, likely to harvest user account credentials through deceptive login portals. The domain is currently offline, though prior activity suggests it may resurface under similar naming conventions or infrastructure. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on November 07, 2025, through Dominet (HK) Limited, a registrar frequently associated with suspicious domains. It resolves to the IP address 5.23.50.27, which has been flagged in 15 threat intelligence pulses. Security vendors have detected malicious activity, with 10 of 95 VirusTotal engines marking the domain as malicious. Additionally, the domain appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. The Gridinsoft trust score for this domain is 0 out of 100, further corroborating its malicious nature. The parked page title, 'Домен припаркован в Timeweb,' suggests it may have been hosted on a service commonly used for temporary or malicious deployments. Current status indicates the domain is offline, though the underlying infrastructure remains a potential threat. Organizations and users are advised to treat any future domains with similar naming patterns or resolving to the same IP range as high-risk. Network-level blocking of the IP 5.23.50.27 is recommended to prevent potential lateral movement or resurgence of this threat. Users who may have interacted with this domain should immediately reset credentials for FACEIT and any associated accounts, enable multi-factor authentication, and monitor for unauthorized activity. Security teams should review logs for connections to the domain or IP to identify potential compromise.