fajstcup[.]com

The domain fajstcup.com has been identified as a phishing infrastructure specifically targeting Russian-speaking users under the guise of an educational development platform. Analysis of the page title, 'Лучшая Образовательная платформа для Развития навыков,' indicates an intent to impersonate legitimate online learning services to harvest user credentials, payment details, or other sensitive information. The domain is currently offline but was operational during its active phishing campaign. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious activity. It resolves to the IP address 172.67.169.6, which has been linked to other suspicious domains. Security vendors on VirusTotal flagged fajstcup.com as malicious, with 6 out of 95 engines detecting it. The domain appears on one security blocklist and is referenced in one AlienVault OTX threat intelligence pulse. Additionally, it holds a Gridinsoft trust score of 0 out of 100, further corroborating its malicious nature. The SSL certificate is issued by Google Trust Services, which, while legitimate, is often exploited by threat actors to lend credibility to phishing sites. Current status indicates the domain has been taken offline, likely due to detection and mitigation efforts. However, the infrastructure may resurface under a different domain or IP address. Organizations and individuals are advised to block the domain fajstcup.com and its associated IP 172.67.169.6 at the network level. Users who may have interacted with the site should reset credentials immediately, particularly if reused across multiple platforms. Monitoring for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to the same IP range is recommended. Security teams should update detection rules to include the domain, IP, and associated indicators of compromise.