fatstcup[.]com

This domain, fatstcup.com, was identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Analysis indicates the infrastructure was configured to mimic legitimate authentication portals, likely targeting users of financial services, corporate platforms, or social media based on observed patterns in similar campaigns. The domain's design and redirection behavior suggest an intent to capture usernames, passwords, and potentially multi-factor authentication tokens for unauthorized account access or identity theft. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolved to the IP address 188.114.96.3, which has been linked to other transient phishing campaigns in recent months. At the time of investigation, fatstcup.com appeared on one security blocklist and was flagged by 4 out of 95 security vendors on a prominent threat intelligence platform. The domain's creation date, combined with its rapid appearance on blocklists, suggests a short-lived but targeted operation typical of credential harvesting schemes. Users who visited fatstcup.com or entered credentials on any site resembling its infrastructure should take immediate action to mitigate potential compromise. All submitted credentials must be considered exposed and should be changed immediately across all platforms where they were reused. Affected users are advised to enable multi-factor authentication on critical accounts and monitor for unauthorized access or transactions. System scans for malware are recommended, as phishing sites often deploy secondary payloads. Organizations should review logs for connections to 188.114.96.3 and the domain itself to identify potentially compromised endpoints.