faceit[.]org-vertex-clubgg[.]com

The domain faceit.org-vertex-clubgg.com was registered on 24 December 2025 through NiceNIC International Group Co., Limited and is hosted on the TIMEWEB network (AS9123 JSC TIMEWEB) in Russia, resolving to IP 92.53.96.141. The authoritative nameservers listed are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org. No TLS certificate is presented, indicating the site is served over plain HTTP. VirusTotal scans have yielded 17 positive detections out of 93 security vendors, and the domain appears on a single external blocklist maintained by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification.

The page title returned from the HTTP response is “FACEIT Cloud Events”, suggesting an attempt to mimic legitimate FACEIT branding, consistent with the classified threat type of brand impersonation. The current operational status is offline, which may be temporary or a takedown action. The risk level is marked as elevated. Analysis indicates that the infrastructure is typical of a short‑lived impersonation campaign: a recently created domain, low‑cost Russian hosting, and no SSL protection. The presence of multiple TIMEWEB nameservers suggests the attacker leveraged a generic hosting provider rather than a dedicated command‑and‑control platform.

Detection counts from VirusTotal and the zero trust score provide strong indicators for automated blocking. However, details such as the exact phishing page content, credential collection mechanisms, or any associated command‑and‑control endpoints remain unknown because the site is no longer reachable. Defenders should update web filtering and DNS blocklists to include the resolved IP 92.53.96.141 and the domain name, enforce HTTPS‑only policies to mitigate exposure to similar non‑TLS sites, and monitor for any new domains registered by the same registrar that use the same TIMEWEB nameserver set.