ffatcup[.]com

This domain, ffatcup.com, poses as a Counter-Strike 2 (CS2) competitive gaming portal, specifically mimicking tournament registration or prize claim pages under the branding 'FASTCUP — Путь к Серьезным победам в CS2!' Analysis indicates the site functions as a generic phishing operation, likely designed to harvest user credentials, payment details, or distribute malware under the guise of esports engagement. The Russian-language page title suggests targeting of Eastern European or CIS-region gaming communities, a demographic frequently exploited in credential theft campaigns tied to popular multiplayer titles. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar historically associated with abusive registrations. It resolves to the IP address 104.21.5.80, a Cloudflare-protected endpoint that obscures origin infrastructure. Detection metrics show 4 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on one security blocklist and has been documented in a single AlienVault OTX threat intelligence pulse. Gridinsoft assigns the domain a trust score of 0/100, further corroborating its malicious classification. Users who visited ffatcup.com should immediately revoke any credentials entered on the site, particularly those associated with gaming accounts, payment platforms, or email services. System scans using updated endpoint protection tools are recommended to detect potential secondary payloads. Browser sessions should be cleared to remove any stored authentication tokens or cookies. Given the domain's offline status, monitoring for related phishing attempts via email or social engineering vectors is advised, as threat actors frequently rotate infrastructure following takedowns. Network-level blocking of the resolved IP (104.21.5.80) may prevent access to other domains hosted on the same malicious infrastructure.