fastsecuritycourierservice[.]xyz[.]finteckgrantbk[.]xyz

The domain www.fastsecuritycourierservice.xyz.finteckgrantbk.xyz is a phishing site engaged in brand impersonation, specifically targeting users of the brand 'across'. This site was designed to deceive visitors by mimicking legitimate courier or security services, posing an elevated risk of credential theft or fraud. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate risk to users.

Technical analysis shows that www.fastsecuritycourierservice.xyz.finteckgrantbk.xyz was flagged by 3 of 95 security vendors on VirusTotal, including Forcepoint ThreatSeeker, SOCRadar, and Webroot. It appears on one security blocklist, PhishDestroy, and was registered through OwnRegistrar, Inc. on March 01, 2025. The domain resolves to the IP address 192.3.190.186, hosted on AS36352 (HostPapa) in the US, with no SSL certificate available. The observed page title was 'Fast Wheels Courier Services', and nameservers are dns1.webproserver.com, dns2.webproserver.com, and null. Gridinsoft assigned a trust score of 0/100 to this domain.

Users who interacted with www.fastsecuritycourierservice.xyz.finteckgrantbk.xyz should take immediate action to secure their accounts. If login credentials were entered, change passwords for the affected service and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized activity and report any suspicious transactions. To report this phishing domain, submit it to Google Safe Browsing, PhishTank, or the impersonated brand's security team. Victims may also file complaints with local cybercrime authorities or organizations like the Anti-Phishing Working Group (APWG).