fastcutp[.]com

fastcutp.com was observed hosting a phishing page whose title reads “Лучшая Образовательная платформа для Развития навыков”. The domain resolves to 172.67.159.247, an address owned by Cloudflare (AS13335) located in the United States. Cloudflare services are confirmed by the presence of the provider’s nameservers (gabe.ns.cloudflare.com, sharon.ns.cloudflare.com) and the detection of HTTP/3 support. The TLS certificate is issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS connection at the time of capture. VirusTotal records show that two of ninety‑four scanning engines flagged the domain as malicious, and the domain appears on a single external blocklist, PhishDestroy, which has already taken it offline.

Registration data from NiceNIC International Group Co., Limited indicates the domain was created on 29 May 2025. No further historical records or redirects were observed before the takedown. Analysis confirms the infrastructure is typical of fast‑flux phishing campaigns that leverage reputable CDN providers to obscure origin. The use of a legitimate‑looking SSL certificate and Cloudflare’s performance features helps the site evade simple URL‑based filters. Because the site is currently offline, real‑time content cannot be inspected; the exact phishing payload, target brand, or credential‑capture mechanism remains unknown.

Defenders should continue to block the domain and its associated IP address at network perimeter and DNS layers. Monitoring for newly registered domains that resolve to the same Cloudflare IP range or that use the same nameservers may reveal follow‑on activity. Updating detection signatures with the observed page title and registrar information can improve early identification. Incident response teams should also consider querying threat‑intel platforms for any future sightings of fastcutp.com or related indicators.