faceit[.]steam-turboarena[.]com

faceit.steam-turboarena.com was registered on February 21, 2026 through Web Commerce Communications Limited dba WebNic.cc and is hosted on the Cloudflare network (AS13335) under the IP address 104.21.48.1, which resolves to a US location. The domain is configured with the authoritative nameservers ns100.webnic.cc and ns101.webnic.cc and presents an SSL certificate identified as WE1, typical of Cloudflare‑issued certificates. Public analysis on VirusTotal shows that three out of ninety‑three scanners flagged the domain, and it is listed on a single security blocklist.

The phishing‑specific blocklist PhishDestroy has already taken the domain offline, and the current status is reported as offline as of the July 22, 2026 assessment. The page title returned from the server is “Anmelden”, which is German for “Login”, aligning with the declared scam type of a gaming‑related impersonation targeting the Steam brand. No additional page content, JavaScript, or credential‑capture mechanisms have been disclosed in the available intelligence, leaving the exact phishing flow uncertain.

The combination of a recent registration date, use of a reputable registrar, and rapid deployment on Cloudflare suggests a low‑cost, throwaway infrastructure typical of brand‑impersonation campaigns. Defenders should update perimeter defenses to block the domain name and its resolving IP address, enforce URL filtering against the observed page title and known blocklist identifiers, and monitor for newly registered domains that reuse the same registrar or nameserver pattern. Continued observation of the Cloudflare edge IP range for similar activity is recommended, as the underlying hosting may change without notice.