fadstcup[.]com

PhishDestroy has identified fadstcup.com as a generic phishing domain currently taken offline. This domain was likely used in a broad phishing campaign, potentially targeting cryptocurrency users or general login credentials. While no specific brand or drainer kit has been confirmed, the domain's generic name and threat classification suggest it could have been deployed in a credential harvesting operation. The domain was created on March 27, 2026, a relatively recent date that aligns with typical phishing domain lifespans, and it was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious domains.

Technical analysis reveals several red flags. VirusTotal flagged this domain with a score of 4 out of 95 security vendors, indicating moderate but notable detection across the cybersecurity community. The domain resolves to IP address 104.21.50.111, which is associated with Cloudflare, a common service used by phishers to obscure their hosting infrastructure. The SSL certificate was issued by Google Trust Services under the WE1 certificate authority. Additionally, the domain appears on 1 security blocklist and was found in 1 threat intelligence pulse on AlienVault OTX, confirming its inclusion in known malicious activity tracking. Google Safe Browsing (GSB) status is offline, meaning the domain is no longer accessible, but this does not eliminate the risk of similar domains being deployed.

As of this report, fadstcup.com is offline, which may be a result of proactive takedown actions by security researchers or hosting providers. However, the risk remains elevated because phishing campaigns often rotate domains rapidly, and the infrastructure behind this domain could be reused for future attacks. Users should remain vigilant and avoid interacting with unsolicited links or emails referencing this domain. PhishDestroy recommends verifying any suspicious URLs through its platform and enabling two-factor authentication on all accounts. The combination of a recent registration date, low reputation registrar, and moderate vendor detection underscores the importance of treating this domain as a confirmed threat, even in its offline state.