faceit[.]stm-auth[.]com

faceit.stm-auth.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The domain resolves to 104.21.83.186, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. DNS is served by chip.ns.cloudflare.com and katja.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. An SSL certificate issued by Google Trust Services (CN = WE1) is present, indicating HTTPS support via Cloudflare’s edge.

HTTP requests return a 404 Not Found status and the page title reports the same, suggesting that no malicious payload is currently hosted. The site is flagged by at least one public blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 16 of 93 scanned security vendors have reported the domain as malicious, reinforcing the suspicion of phishing intent. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, all typical of Cloudflare‑protected sites.

The limited public visibility—only a 404 response—prevents confirmation of the exact phishing content or targeted brand. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any change in HTTP response or content, and consider adding the domain to internal blocklists. Ongoing observation of the IP address and associated Cloudflare zone is advised, as the infrastructure could be reused for future malicious campaigns.