faceit[.]auth-vertexclub[.]com

faceit.auth-vertexclub.com was observed hosting a page titled “FACEIT Cloud Events”. The site was registered on 28 October 2025 through Dominet (HK) Limited and uses four Timeweb nameservers (ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, ns4.timeweb.org). DNS resolution points to 92.53.96.105, an address owned by AS9123 JSC TIMEWEB located in Russia. No TLS certificate was presented, indicating the site operated over HTTP only.

The page’s content is classified as a brand‑impersonation campaign, with the “impersonates: across” tag suggesting the actors target multiple brands, although the exact victim list is not disclosed. Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100. The domain appears on a single external blocklist and was actively blocked by the PhishDestroy service before being taken offline. VirusTotal scans show 15 of 95 AV engines flagging the domain as malicious, reinforcing the suspicion of fraudulent activity.

The limited public footprint combined with the recent registration date points to a short‑lived infrastructure typical of opportunistic impersonation attacks. Defenders should add the resolved IP (92.53.96.105) and the associated nameserver range to their deny lists, monitor for new domains registered with the same registrar or nameserver pattern, and enforce strict HTTPS requirements to prevent users from being redirected to unsecured sites. Continuous observation of the “across” impersonation tag is advised to anticipate future brand‑specific lures that may reuse this hosting profile.