fwastcup[.]com

This domain, fwastcup.com, operates as a credential harvesting platform specifically targeting users of financial services, including online banking and digital payment systems. Analysis indicates the site employs cloned interfaces of legitimate financial institutions to deceive victims into submitting sensitive authentication details, such as usernames, passwords, and multi-factor authentication codes. The infrastructure is optimized for rapid deployment and evasion, with a focus on mimicking regional banks and payment processors to maximize success rates. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 3 out of 95 security vendors on VirusTotal, including detections for phishing and social engineering. It appears on one security blocklist and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusually future-dated registration that suggests potential domain spoofing or backdated records. The domain resolves to IP address 172.67.171.35, which has been linked to prior phishing campaigns and is associated with a content delivery network frequently exploited for malicious hosting. Additionally, the domain was identified in one threat intelligence pulse on a major threat exchange platform, further corroborating its use in active credential theft operations. Users who have visited fwastcup.com or interacted with its content should immediately take corrective action to mitigate potential compromise. All credentials entered on the site must be considered exposed and should be changed immediately across all platforms where the same or similar passwords were reused. Enable multi-factor authentication on all critical accounts, particularly financial services, and monitor for unauthorized transactions or login attempts. System scans using updated security tools are recommended to detect any secondary payloads or malware that may have been delivered. If financial information was submitted, contact the relevant institution to report potential fraud and request account monitoring. Organizations should update their security policies to block access to this domain and its associated IP address to prevent further exposure.