fmstcup[.]com

The domain fmstcup.com has been identified as a credential harvesting phishing site targeting corporate users under the guise of professional development portals. Analysis confirms the domain is currently offline, though it previously hosted content impersonating legitimate training or career advancement platforms, as indicated by its Cyrillic page title referencing personal growth and collaboration. No specific brand impersonation has been confirmed, but the thematic approach aligns with common credential theft tactics used in enterprise environments. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 104.21.13.181, a Cloudflare-associated address often leveraged to obfuscate hosting origins. Detection metrics indicate elevated risk, with 6 of 95 security vendors on VirusTotal flagging the domain as malicious. Additional intelligence sources report a Gridinsoft trust score of 0 out of 100 and inclusion on at least one security blocklist, specifically PhishDestroy. The domain’s creation date in the future (2026) further suggests an attempt to evade reputation-based filtering systems. Current status confirms fmstcup.com has been taken offline, likely in response to detection and mitigation efforts. Organizations are advised to block the domain and its associated IP at the network perimeter to prevent residual access attempts. Security teams should monitor for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to 104.21.13.181, as these indicators may signal related phishing infrastructure. End-user training should emphasize vigilance against unsolicited professional development or training-themed communications, particularly those containing non-Latin characters or urgent calls to action.