esl[.]beneluxtours[.]com

The domain esl.beneluxtours.com was registered on November 29, 2025 through Hello Internet Corp and resolves to the Cloudflare IP address 188.114.96.3, which is announced by AS13335 in the United States. The domain does not present an SSL certificate, and its Gridinsoft trust score is 0 out of 100, indicating a lack of reputation. The site title captured in the intelligence feed is "National Championship - ESL Benelux," which bears no obvious relation to the advertised brand. However, the domain is explicitly marked as impersonating Twitch, and the scam type is identified as brand impersonation.

It appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal analysis shows that four of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious use. Current status indicates the domain has been taken offline, but its infrastructure remains observable, and the nameservers listed are jasper.ns.cloudflare.com and nataly.ns.cloudflare.com, both hosted by Cloudflare.

Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP address and nameservers, and consider adding the domain to internal blacklists even though it is offline, as threat actors often reactivate or clone similar infrastructure. Ongoing threat‑intel feeds should be consulted for any re‑registration or similar domains that reuse the same registrar, hosting provider, or naming pattern. The limited detection footprint suggests a focused campaign rather than a broad‑scale operation, but the presence of brand impersonation targeting Twitch warrants heightened vigilance, especially for organizations that manage Twitch credentials or communications.