faspcup[.]com

This domain, faspcup.com, is flagged as a generic_phishing infrastructure targeting users of the popular first-person shooter game Counter-Strike 2. The page title, "FASTCUP - Твой путь в мир Counter-Strike 2!," suggests an attempt to impersonate a legitimate gaming tournament or community platform, likely aiming to harvest credentials, payment details, or distribute malware under the guise of in-game rewards or event registration. No specific drainer kit signatures were identified in the available telemetry, but the use of modern web technologies and content delivery networks indicates an effort to evade detection and enhance scalability for malicious campaigns. Infrastructure analysis reveals the following technical indicators: the domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and was created on March 27, 2026, a future date that may indicate registry manipulation or a placeholder. It resolves to the IP address 172.67.175.54, which is associated with a known content delivery network provider. VirusTotal reports 5 out of 95 security vendors flagging this domain as malicious, while it appears on one additional security blocklist. The domain has a Gridinsoft trust score of 0/100, further corroborating its malicious classification. Technologies detected include Unpkg, Cloudflare Browser Insights, Cloudflare (HTTP/3), and AOS, which are commonly used to obfuscate malicious activity and improve performance. As of the latest assessment, faspcup.com has been taken offline, likely due to enforcement actions by security providers or hosting infrastructure. However, the elevated risk level persists due to the domain's recent activity and the potential for re-emergence under similar or altered infrastructure. Users who may have interacted with this domain are advised to reset credentials for gaming accounts, enable multi-factor authentication, and monitor for unauthorized transactions or account activity. Organizations should update blocklists to include this domain and its associated IP address, while security teams should investigate related infrastructure for signs of lateral movement or secondary payload delivery.