fasetcup[.]com

The domain fasetcup.com is identified as a credential theft phishing site, designed to harvest user login credentials through deceptive login portals. As of the latest assessment, the domain has been taken offline, though prior activity indicates a targeted effort to mimic legitimate authentication interfaces. No specific brand impersonation has been confirmed, but the domain’s infrastructure and historical behavior align with credential harvesting operations. Analysis of the domain reveals multiple elevated-risk indicators. The domain is flagged by 7 of 95 security vendors on VirusTotal, with additional detections across 8 threat intelligence pulses in public repositories. It resolves to the IP address 104.21.56.42, a host with a history of association with malicious activity. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, the domain appears to have been created with a future date, a tactic occasionally used to evade immediate detection. The domain is listed on one security blocklist, and its trust score is rated at 0/100 by independent assessment platforms. Given the domain’s current offline status, immediate threats to end users are mitigated. However, organizations should remain vigilant, as infrastructure associated with this domain may be reactivated or repurposed. Network defenders are advised to add fasetcup.com to domain blocklists and monitor for any resolution attempts to 104.21.56.42. Security teams should review logs for prior connections to this domain or IP, particularly in cases of suspected credential compromise. Proactive measures, such as implementing multi-factor authentication and user awareness training on phishing tactics, are recommended to reduce exposure to similar threats.