fasctjup[.]com

This domain, fasctjup.com, is flagged as a credential theft operation designed to harvest user login credentials through deceptive phishing portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the infrastructure aligns with generic credential harvesting campaigns. The domain employs social engineering tactics, such as fake login pages, to trick users into submitting sensitive information, which is then exfiltrated to attacker-controlled servers.

Technical indicators reveal the following: VirusTotal detection ratio of 2/95 security vendors, indicating limited but confirmed malicious activity. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently exploited for malicious registrations. It resolves to the IP address 104.21.45.120, a Cloudflare proxy endpoint commonly used to obfuscate hosting infrastructure. The domain appears on one security blocklist and is currently not flagged by Google Safe Browsing (GSB). Infrastructure analysis reveals no additional subdomains or associated certificates at this time.

As of the latest assessment, fasctjup.com has been taken offline, likely due to hosting provider or registrar intervention. However, the elevated risk level persists due to the domain's recent creation and confirmed malicious intent. Organizations are advised to block the domain and its resolving IP at the network perimeter. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and monitor for unauthorized activity. Continuous monitoring of related infrastructure is recommended, as threat actors may re-establish operations under similar domains or IPs.