twitch-rust[.]top

Analysis of twitch-rust.top indicates a brand impersonation domain targeting Twitch users, specifically leveraging the 'Twitch Drops' program. The domain was registered on December 20, 2025, and resolved to IP 62.60.226.105, hosted under AS214351 (FEMO IT SOLUTIONS LIMITED) in Germany. No SSL certificate was detected, increasing the risk of unencrypted data transmission. The page title, 'Rust | Twitch Drops,' directly references Twitch's incentive system, suggesting an attempt to deceive users expecting legitimate in-game rewards.

Infrastructure review reveals the domain was registered via PDR Ltd. d/b/a PublicDomainRegistry.com, with nameservers ns1.eternitynames.net through ns4.eternitynames.net. As of July 23, 2026, the domain is offline, though it appeared on one security blocklist and was flagged by 16 of 93 vendors in VirusTotal scans. AlienVault OTX recorded it in a single threat intelligence pulse, while Gridinsoft assigned a trust score of 0/100. PhishDestroy lists it as blocked.

Defenders should treat this domain as high-risk due to its brand impersonation tactics, lack of SSL, and detection by multiple security vendors. While the site is currently inaccessible, historical DNS and WHOIS records should be preserved for forensic analysis. No evidence confirms the exact payload or user interaction methods, but the combination of Twitch branding and 'Drops' terminology aligns with credential harvesting or malware distribution campaigns. Further monitoring of associated IPs and nameservers is recommended to identify related malicious infrastructure.