twitchgiftdrop[.]com

Analysis of twitchgiftdrop.com indicates a phishing domain impersonating Twitch, currently offline as of July 23, 2026. The domain was registered on July 26, 2025, through NiceNIC International Group Co., Limited, and employs Cloudflare nameservers (alberto.ns.cloudflare.com, itzel.ns.cloudflare.com). Infrastructure review reveals Cloudflare hosting (AS13335) with an IPv6 address of 2606:4700:3031::6815:2a2, located in the US. The SSL certificate, issued by Google Trust Services (WE1), supports HSTS and HTTP/3 protocols, a configuration consistent with modern phishing infrastructure aiming to appear legitimate.

The domain was flagged by 7 of 95 security vendors on VirusTotal and appears in one AlienVault OTX threat intelligence pulse, suggesting prior detection by the security community. Gridinsoft assigns a trust score of 1/100, further indicating malicious intent. The page title, 'Rust | Twitch Drops,' aligns with Twitch’s brand and drop campaigns, reinforcing the impersonation angle. At the time of this report, the domain returns an HTTP 403 status, and it is blocked by PhishDestroy, with one confirmed security blocklist listing.

Defenders should treat this domain as confirmed phishing infrastructure targeting Twitch users. While the exact content of the phishing page is not analysed, the combination of brand impersonation, low trust scores, and detection by multiple security vendors justifies elevated risk classification. Organizations are advised to block the domain at the DNS or proxy level and monitor for related infrastructure, particularly domains registered through the same registrar or leveraging Cloudflare with similar naming patterns. No evidence currently links this domain to active malware distribution or credential harvesting beyond brand impersonation.