fnastcup[.]com

This domain, fnastcup.com, is identified as a fake login phishing portal designed to harvest user credentials. Analysis indicates the site is currently offline, though prior activity suggests it was actively impersonating legitimate authentication pages to deceive victims. No specific brand impersonation has been confirmed, but the infrastructure aligns with credential-theft campaigns targeting generic login forms. Infrastructure analysis reveals the domain was created on March 27, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.158.46, a host shared with other low-reputation domains. Security telemetry shows the domain was flagged by 3 of 95 vendors on VirusTotal, appears on 1 security blocklist, and is referenced in 1 threat intelligence pulse on a public threat exchange platform. The domain’s registration details and hosting provider exhibit patterns consistent with disposable phishing infrastructure. The domain is currently offline, but historical indicators suggest it may resurface under altered infrastructure. Organizations are advised to block the domain and associated IP at perimeter defenses, monitor for credential reuse attempts from harvested data, and review logs for prior connections to 172.67.158.46. Users who may have interacted with the site should reset credentials immediately and enable multi-factor authentication on all accounts. Security teams should treat this domain as part of a broader credential-phishing campaign and correlate with other known fake login portals.