fastccp[.]com

Analysis of fastccp.com shows a newly created domain that has been used in a generic phishing campaign. The domain was registered through NiceNIC International Group Co., Limited on March 5, 2026 and resolves to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. No SSL certificate is presented, so the site operates over plain HTTP. Detected technologies include Unpkg, Cloudflare, AOS and support for HTTP/3, indicating reliance on widely used content delivery and script hosting services. The only visible page title retrieved, “FASTCUP - Твой путь в мир Counter-Strike 2!”, suggests the site is attempting to lure users interested in the Counter‑Strike 2 game, a common vector for credential‑stealing pages.

VirusTotal scans recorded two detections out of ninety‑four security vendors, providing limited but notable confirmation of malicious intent. The domain is currently listed on a single external security blocklist and has been blocked by the PhishDestroy service. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the elevated risk classification. Nameserver records point to expired-ns1.niceisp.com and expired-ns2.niceisp.com, which are typical of short‑lived phishing infrastructure. The site’s status is offline at the time of reporting, yet the infrastructure artifacts remain actionable.

Defenders should add fastccp.com to internal URL filtering and DNS block lists, monitor traffic to the associated Cloudflare IP for any residual activity, and enforce TLS inspection to detect any future attempts to serve the same content over encrypted channels. Because the underlying phishing kit or exact credential‑capture method has not been disclosed, analysts should continue to gather samples if the site reappears and compare them against known kits. Monitoring for new domains registered by the same registrar or using the same nameservers may provide early warning of related campaigns.