faceit[.]twich-vertex-club[.]com

The domain faceit.twich-vertex-club.com was registered on November 5, 2025 through Dominet (HK) Limited and is currently taken offline. Technical analysis shows the domain resolves to the IPv6 address 2a03:6f00:1::5c35:608d, which belongs to the Russian hosting provider JSC TIMEWEB (AS9123). The authoritative name servers listed are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, ns4.timeweb.org, and pns61.cloudns.net, indicating reliance on TIMEWEB’s DNS infrastructure. No TLS certificate was observed, meaning connections are unencrypted and the site cannot present a trusted HTTPS identity.

Trust‑rating services rate the domain extremely low, with Scamadviser scoring 1 out of 100 and Gridinsoft assigning a zero score. The site appears on a single security blocklist and is explicitly blocked by PhishDestroy, confirming that at least one protective feed has flagged it. VirusTotal scans recorded 14 detections out of 95 security vendors, reinforcing the malicious classification. The page title returned from the site is "FACEIT Cloud Events," and the threat is catalogued as a brand impersonation campaign targeting multiple brands (noted as "across").

The limited public evidence does not reveal the exact content or credential‑harvesting mechanisms employed, so the precise phishing kit remains unknown. Defenders should continue to block the domain at network perimeters, update proxy and DNS filters with the observed IPv6 address and name‑server set, and monitor for any re‑registration attempts. Given the low trust scores, absence of SSL, and multiple vendor detections, the domain should be treated as high‑risk and incorporated into threat‑intel feeds for rapid containment.