verify[.]faceitxrush[.]top

The domain verify.faceitxrush.top is a phishing site engaged in brand impersonation, specifically targeting Facebook users. It presents itself as a legitimate Facebook-related service but is designed to deceive victims through QR code hijacking techniques. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate risk, though prior visitors may remain exposed to credential theft or unauthorized account access.

Technical analysis shows verify.faceitxrush.top was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appears on 1 security blocklist (PhishDestroy). Google Safe Browsing did not flag the domain. Registered through Atak Domain Bilgi Teknolojileri Inc. on August 25, 2025, the domain resolves to IP address 87.120.126.43, hosted on AS215730 (H2NEXUS LTD) in Germany. The SSL certificate is issued by GlobalSign nv-sa (GlobalSign GCC R6 AlphaSSL CA 2025), and the observed page title was 'Pick Your Team and Start Playing'. Nameservers include ns0.1984.is and ns1.1984hosting.com. Gridinsoft assigned a trust score of 0/100.

Individuals who interacted with verify.faceitxrush.top should immediately change any passwords used on the site, particularly for Facebook accounts. Enable two-factor authentication (2FA) on all linked services to prevent unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins or messages sent without consent. Report the domain to Facebook’s abuse team via their official reporting channels and submit it to additional blocklists like PhishTank or OpenPhish for broader awareness.