twltch[.]fecepunch[.]pro

The domain twltch.fecepunch.pro was observed to resolve to the IPv4 address 178.16.52.90, which is assigned to AS202412 (Omegatech LTD) and geolocated to Germany. Registration data show the domain was created on 18 December 2025 and is listed under the registrar PDR Ltd. d/b/a PublicDomainRegistry.com, using Cloudflare authoritative nameservers emily.ns.cloudflare.com and konnor.ns.cloudflare.com. No TLS certificate was presented at the time of inspection, indicating that HTTPS was not available for the site. The page title returned by HTTP requests is "Rust | Twitch Drops", which aligns with the declared scam type of brand impersonation targeting the Twitch platform.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist, confirming that at least one external sinkhole has flagged the host. VirusTotal analysis reports 14 of 95 scanning engines flagging the domain as malicious, providing additional independent corroboration of its abusive nature. PhishDestroy has also listed the domain as blocked, further indicating that security vendors consider the host to be a threat.

The current operational status is reported as offline, which may limit immediate exploitation but does not remove the risk associated with the infrastructure that could be reused. Defenders are advised to add the IP address 178.16.52.90 and the domain name to block lists, monitor DNS queries for the associated Cloudflare nameservers, and ensure that any user‑facing services that reference Twitch drops are validated against official Twitch endpoints. Continuous observation of the registrar and the hosting ASN is recommended to detect potential re‑registration or migration of the malicious campaign.