twich-vertex-club[.]com

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users by mimicking the Across platform. The intent appears to be credential theft or fraudulent transaction facilitation, leveraging the trust associated with the legitimate brand to exploit victims. Analysis indicates a targeted campaign, given the specificity of the impersonated entity and the technical infrastructure employed. Infrastructure analysis reveals the domain twich-vertex-club.com was registered on November 05, 2025, through Dominet (HK) Limited, a registrar historically associated with abusive domains. It resolves to the IPv6 address 2a03:6f00:1::5c35:608d, hosted within the Russian autonomous system AS9123 (JSC TIMEWEB). The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user data in transit. It is currently offline but was previously active with the page title "FACEIT Cloud Events," suggesting an attempt to lure users under false pretenses. The domain appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal, indicating moderate but consistent detection across the security community. Mitigation steps for organizations and end-users include immediate blocking of the domain at the network perimeter and endpoint levels. Security teams should monitor for any residual DNS queries or attempted connections to the associated IP address. Users who may have interacted with the domain should be advised to reset credentials for any accounts accessed during the potential exposure window, particularly those associated with the Across platform. Additionally, organizations should review logs for any successful connections to the domain or its IP, as this may indicate compromised credentials or ongoing malicious activity. Given the domain's registration date and hosting infrastructure, continuous monitoring for similar impersonation domains registered through the same registrar or hosted on the same AS is recommended.