twich-gglegendscup[.]com

Twich-gglegendscup.com impersonates several brands, including 'across', 'cs2', 'csgo', 'revolut', 'steam', and 'steamcommunity'. The site, titled 'FACEIT Cloud Events', aims to deceive users by mimicking legitimate gaming and financial platforms. The domain was registered with Dominet (HK) Limited and hosted on an IP address located in Russia under JSC TIMEWEB.

Despite being taken down, the domain was flagged as malicious by 13 out of 95 vendors on VirusTotal and is listed on two public blocklists, including PhishDestroy and PhishingDB. The absence of an SSL certificate further indicates its fraudulent nature. The platform risk score is relatively low at 30/100, but the domain's rapid detection on the day of its creation underscores its potential threat.

PhishDestroy's early detection pipeline identified this domain on October 23, 2025, the same day it was created. This highlights the domain's attempt to exploit the critical window before antivirus databases update their records. The domain's impersonation strategy suggests a sophisticated approach to lure users into divulging sensitive information or redirecting them to malicious sites. The swift takedown of twich-gglegendscup.com minimizes its impact, but the incident serves as a reminder of the ongoing threat posed by impersonation scams.