auth-victoryhub[.]com

auth-victoryhub.com was observed hosting a page titled “FACEIT Cloud Events”. The site is classified as a brand‑impersonation campaign targeting the Across brand. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 87.249.38.179, which belongs to AS9123 JSC “TIMEWEB” in Russia. No TLS certificate is presented, indicating the site is served over plain HTTP. Nameserver delegation points to ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org and ns4.timeweb.org, confirming the use of the TIMEWEB hosting platform.

Threat intelligence sources corroborate the malicious purpose. AlienVault OTX lists the domain in fifteen separate pulses, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one external security blocklist and is actively blocked by the PhishDestroy sink‑hole. VirusTotal scans show that nineteen of ninety‑three antivirus and URL‑reputation engines flag the domain as malicious, reinforcing the assessment of an active impersonation operation.

The current operational status is “offline”, suggesting that the phishing infrastructure has been taken down or is temporarily unavailable. However, the infrastructure components—namely the Russian hosting provider, the lack of encryption, and the persistent blocklist entries—remain usable for future campaigns. Defenders should continue to monitor the IP address 87.249.38.179 for any re‑activation, enforce blocklisting of the domain in network and endpoint security solutions, and add the associated nameservers to threat‑intel feeds. Organizations using the Across brand should educate users about unsolicited communications that reference “FACEIT Cloud Events” and advise verification through official channels before interacting with any links pointing to this domain.