fbastcup[.]com

This domain, fbastcup.com, is flagged as a credential theft phishing operation designed to harvest user login credentials through deceptive web pages. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though the infrastructure aligns with common phishing frameworks used for broad-scale credential harvesting. The domain exhibits characteristics typical of credential theft campaigns, including the use of obfuscated landing pages and form submissions to exfiltrate sensitive data. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and is currently listed on one security blocklist. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while AlienVault OTX includes it in one threat intelligence pulse. The domain has not been observed in Google Safe Browsing (GSB) at the time of this report. The registrar and hosting provider are consistent with those frequently used in phishing operations, though no additional subdomains or linked infrastructure have been identified. As of the latest assessment, fbastcup.com has been taken offline, likely due to mitigation efforts by hosting providers or domain registrars. The domain was actively blocked by PhishDestroy prior to its deactivation. Despite its current offline status, residual risk remains due to potential re-registration or migration of the phishing infrastructure to alternative domains. Organizations are advised to monitor for similar domains registered through the same registrar or resolving to the identified IP address. Network-level blocking of the IP 188.114.97.3 is recommended as a precautionary measure. End-users should be educated on recognizing credential theft tactics, particularly those involving unsolicited login prompts or requests for sensitive information.