eng-victory-hub[.]com

The domain eng-victory-hub.com has been identified as a generic phishing resource targeting users of the FACEIT Cloud Events platform. Analysis confirms the domain was actively impersonating the legitimate FACEIT service, as evidenced by the page title 'FACEIT Cloud Events' and its design intent to deceive users into disclosing credentials or sensitive information. The domain is currently offline, though prior activity warrants continued monitoring. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolved to the IP address 87.249.38.179, hosted within the Russian Federation under autonomous system AS9123 (JSC 'TIMEWEB'). Detection metrics indicate the domain was flagged by 19 of 95 security vendors on VirusTotal, while appearing on two distinct security blocklists. The SSL certificate, issued by GlobalSign nv-sa (GlobalSign GCC R3 DV TLS CA 2020), provided a superficial layer of legitimacy but did not mitigate the underlying malicious intent. Additional indicators include prior blocking by PhishDestroy and PhishingDB, reinforcing its classification as a confirmed phishing resource. As of the latest assessment, eng-victory-hub.com has been taken offline, though residual risks may persist through cached content or secondary distribution channels. Organizations and users are advised to implement proactive measures, including the integration of the domain and associated IP into internal blocklists. Network administrators should monitor for residual connections to 87.249.38.179 and review logs for prior interactions. End-users who may have engaged with the domain should initiate credential rotation for any potentially compromised accounts, particularly those linked to gaming or cloud-based platforms. Continuous vigilance is recommended, as threat actors frequently repurpose infrastructure for subsequent campaigns.