frastcup[.]com

This domain, frastcup.com, is identified as a crypto drainer phishing infrastructure designed to siphon cryptocurrency assets from victims through deceptive wallet connection prompts. Analysis indicates the domain mimics legitimate decentralized finance (DeFi) platforms, employing social engineering tactics to trick users into authorizing malicious transactions. No specific brand impersonation has been confirmed, though the attack pattern aligns with common MetaMask and Web3 wallet drainer kits observed in recent campaigns. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which has been linked to other phishing and malicious hosting activities. VirusTotal detection metrics show 3 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing (GSB) does not currently list it. The domain appears on one security blocklist, and AlienVault OTX records it in a single threat intelligence pulse, suggesting limited but targeted distribution. As of the latest assessment, frastcup.com has been taken offline, likely in response to detection and blocking by security mechanisms such as PhishDestroy. Despite its current inactive status, the domain remains a residual risk due to potential re-registration or migration to alternative infrastructure. Organizations and users are advised to maintain updated blocklists, monitor for related indicators of compromise (IoCs), and implement wallet transaction simulation tools to detect unauthorized asset transfers. Continuous vigilance is recommended, as threat actors frequently repurpose or rebrand phishing domains to evade detection.