engvertexclub[.]com

This domain, engvertexclub.com, is identified as a brand impersonation site specifically targeting the Across platform. Analysis indicates the site masquerades as a legitimate service, likely to deceive users into engaging with fraudulent content or disclosing sensitive information. The page title, FACEIT Cloud Events, suggests an attempt to mimic cloud-based gaming or event platforms, though no direct evidence of a crypto drainer or credential theft kit was observed in the available data. The domain’s infrastructure and registration details align with patterns commonly associated with brand impersonation campaigns, where attackers exploit trust in established brands to facilitate fraudulent activities. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on January 11, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 87.249.38.179, located in Russia under AS9123 (JSC TIMEWEB), a hosting provider known for harboring malicious activity. Security vendors on VirusTotal flagged the domain with a score of 17/95, indicating moderate to high confidence in its malicious nature. Additionally, the domain appears on two security blocklists, PhishDestroy and PhishingDB, and was assigned an SSL certificate labeled R13, which may indicate automated or low-trust issuance. The domain’s creation date, combined with its rapid flagging by security vendors, suggests a short-lived, high-impact campaign. As of the latest assessment, engvertexclub.com has been taken offline, reducing immediate exposure to end users. However, the domain’s infrastructure remains a latent risk, as threat actors may reactivate it or repurpose similar domains for future campaigns. The elevated risk level is justified by the domain’s association with brand impersonation, its presence on multiple blocklists, and its hosting within a known high-risk autonomous system. Organizations and users are advised to monitor for related domains, particularly those registered through the same registrar or resolving to the same IP range. Proactive blocking of the domain and its associated IP address is recommended to mitigate potential future threats. Continued vigilance is necessary, as threat actors often rotate infrastructure to evade detection.