twich-legends-cup[.]com

Analysis of the domain twich-legends-cup.com indicates a brand impersonation phishing infrastructure targeting users through fraudulent event or promotion pages. The domain was registered on October 18, 2025, via Dominet (HK) Limited and resolved to the IP address 92.53.96.105, hosted on AS9123 JSC TIMEWEB in Russia. No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'FACEIT Cloud Events,' suggests an attempt to impersonate legitimate esports or gaming event platforms, though the exact content and functionality of the site remain unverified due to its current offline status. Infrastructure analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, with detections from PhishDestroy and inclusion on one security blocklist.

AlienVault OTX recorded the domain in two threat intelligence pulses, further corroborating its malicious classification. The Gridinsoft trust score of 0/100 aligns with the observed indicators of compromise. Nameservers associated with the domain include ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, ns4.timeweb.org, and pns61.cloudns.net, which are consistent with hosting providers commonly exploited for phishing operations. Defenders should treat this domain as confirmed malicious infrastructure.

While the site is currently offline, historical resolution data and threat intelligence feeds provide sufficient evidence for blocking or monitoring. Network-level protections should be implemented to prevent resolution of this domain, and any associated IP addresses should be evaluated for broader malicious activity. The absence of SSL and the use of a high-risk registrar further justify elevated scrutiny. Additional forensic analysis of the site's content, if recovered, may reveal specific phishing kits or payloads, but current evidence supports classification as a brand impersonation threat.