faceitt[.]verifytf2[.]com

Analysis of the domain faceitt.verifytf2.com indicates it was actively involved in a brand-impersonation campaign targeting Steam users. The domain was registered on October 31, 2025, through Dominet (HK) Limited and resolved to the IP address 104.21.64.95, which is associated with Cloudflare, Inc. (AS13335) in the United States. The domain utilized Cloudflare nameservers (josephine.ns.cloudflare.com and newt.ns.cloudflare.com) and lacked an SSL certificate, increasing its risk profile for credential interception. Security vendor detections on VirusTotal showed 14 out of 95 engines flagging the domain as malicious, a signal of elevated risk but not universal consensus.

Additional trust assessments reinforce this concern: Gridinsoft assigned a trust score of 0/100, Scamadviser rated it 1/100, and the domain appeared on at least one security blocklist. The page title, 'GO VERIFY YOURSELF,' suggests an attempt to prompt users into submitting credentials under false pretenses, consistent with phishing tactics targeting Steam accounts. At the time of this report (July 23, 2026), the domain has been taken offline, and no live content is accessible.

However, the infrastructure and detection history remain relevant for historical analysis and threat correlation. Defenders should treat this domain as confirmed malicious and include it in blocklists or monitoring systems to prevent potential reuse. While the exact phishing kit or payload is not specified in available data, the combination of brand impersonation, low trust scores, and vendor detections strongly supports its classification as a credential-theft operation.