fastkava[.]com[.]pl

Analysis of fastkava.com.pl shows an active infrastructure hosting a generic phishing site targeting users interested in a self‑service coffee franchise. The domain was registered on 22 April 2025 and resolves to IP 5.187.55.12, located in Poland and announced by AS197155 (Artnet Sp. z o.o.). The web server runs Apache HTTP with a PHP‑based WordPress stack backed by MySQL and enhanced by jQuery, Google Tag Manager, Google Analytics, and a Facebook Pixel. The site presents a valid SSL certificate from Let’s Encrypt (YE1) and returns HTTP 200 for the root request. Threat intelligence flags the domain on a single security blocklist and records a block by PhishDestroy. VirusTotal scans show four of ninety‑one vendors flagging the host, and AlienVault OTX includes the domain in fourteen separate threat pulses, reinforcing its malicious reputation. While the page title "Kawiarnia samoobsługowa w Polsce. Franczyza kawiarni FASTKAVAFASTKAVA" indicates the impersonated brand, the exact phishing content has not been publicly disclosed. Defenders should block the domain and its associated IP at network perimeters, monitor DNS queries for the listed nameservers (ns1.nodea.net.pl, ns2.nodea.net.pl), and enforce URL filtering for the observed SSL fingerprint. Continuous observation of related threat feeds is advised to capture any evolution of the campaign.