fasftcup[.]com

This domain, fasftcup.com, is identified as a credential theft operation targeting users of the popular first-person shooter game Counter-Strike 2 (CS2). The site presents itself as a legitimate gaming platform under the name FASTCUP, using the Russian tagline 'Путь к Серьезным победам в CS2!' ('Path to Serious Victories in CS2!'). Analysis indicates the site is designed to harvest login credentials, likely for subsequent account takeovers, unauthorized in-game purchases, or resale on underground forums. The threat extends beyond immediate financial loss, as compromised accounts may be used to distribute malware or conduct further social engineering attacks against victims' contacts. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains due to its lenient registration policies. It currently resolves to the IP address 104.21.39.57, which belongs to a content delivery network often exploited to mask the true origin of phishing infrastructure. Detection metrics further substantiate the threat: 3 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on one security blocklist, specifically PhishDestroy. The discrepancy between the creation date (2026) and current detection suggests either a typo-squatting attempt or an error in registration records, both common in phishing operations. Users who visited fasftcup.com should take immediate remediation steps. First, terminate any active sessions on the site and avoid entering further credentials. If login details were submitted, change passwords for the affected account and any other platforms where identical credentials were reused. Enable multi-factor authentication (MFA) where available, as this significantly reduces the risk of unauthorized access. Monitor the account for suspicious activity, such as unrecognized logins or transactions, and report any anomalies to the platform's support team. Additionally, scan the device used to access the site for malware, as credential theft sites often deploy secondary payloads. Finally, consider notifying contacts who may be targeted through compromised accounts, as attackers frequently leverage stolen credentials to propagate further scams.