ffstcup[.]com

This domain, ffstcup.com, is identified as a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the infrastructure mimics legitimate login pages, likely targeting financial services, email providers, or corporate access points to capture sensitive account details. The domain employs social engineering tactics to trick users into submitting usernames, passwords, and potentially multi-factor authentication codes, which are then exfiltrated to attacker-controlled servers for unauthorized access or identity theft. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3 and is flagged by 4 out of 95 security vendors on VirusTotal, including detections for phishing and fraudulent activity. The domain appears on one security blocklist and has been documented in a single AlienVault OTX threat intelligence pulse, further corroborating its malicious intent. Gridinsoft assigns a trust score of 0/100, reinforcing the elevated risk assessment. Users who visited ffstcup.com or entered credentials on any page hosted under this domain should immediately take corrective action. Reset passwords for all accounts accessed from the compromised session, prioritizing financial, email, and work-related platforms. Enable multi-factor authentication where available, using app-based or hardware tokens instead of SMS-based methods. Monitor accounts for unauthorized transactions, password change notifications, or suspicious login attempts. If corporate credentials were exposed, notify internal security teams to initiate incident response protocols. Consider scanning affected devices for malware, as phishing sites may deploy additional payloads to maintain persistence or exfiltrate further data.