faceit[.]eng-victory-hub[.]com

Analysis indicates that the domain faceit.eng-victory-hub.com is currently active and classified as a generic phishing site. The domain was registered on February 21 2026 through NiceNIC International Group Co., Limited and is hosted on infrastructure owned by JSC “TIMEWEB” in Russia (AS9123). DNS resolution points to a single IPv4 address, 87.249.38.179, which is served by the same provider. The authoritative name servers are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org, confirming the use of TIMEWEB’s DNS platform. An HTTPS connection presents a GlobalSign nv‑sa certificate chained to the GlobalSign GCC R3 DV TLS CA 2020, indicating a valid, publicly trusted TLS certificate but offering no mitigation against the underlying malicious intent.

HTTP monitoring shows a 302 redirect response, a common technique for steering visitors to credential‑harvesting pages. The site’s visible title, “FACEIT Cloud Events,” suggests an attempt to impersonate official FACEIT communications, although the page content has not been publicly disclosed. Threat intelligence feeds have already flagged the domain: one external security blocklist lists it, PhishDestroy has issued a block, and VirusTotal reports that 16 of 93 scanning engines label the domain as malicious. The Gridinsoft trust score of 0 / 100 further corroborates the high risk assessment.

Given the limited exposure—only a single blocklist entry—but the presence of multiple vendor detections, defenders should treat the domain as hostile. Recommended actions include adding the domain and its resolved IP address to network‑level deny lists, configuring web proxies to block any HTTP 302 redirects to the host, and monitoring for any outbound connections to 87.249.38.179. Continuous re‑evaluation is advised, as additional detections could emerge and the content behind the redirect may change. Until further forensic analysis of the landing page is completed, the domain remains a high‑risk phishing vector.