fawstcup[.]com

The domain fawstcup.com has been identified as a credential harvesting phishing site designed to deceive users into disclosing sensitive login credentials. Analysis indicates this infrastructure was actively employed to mimic legitimate authentication portals, though no specific brand impersonation has been confirmed at this time. The domain is presently offline, mitigating immediate risk to end users. Infrastructure analysis reveals fawstcup.com was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolved to the IP address 188.114.97.3, a host previously linked to multiple phishing campaigns. Security telemetry shows the domain was flagged by 4 of 95 vendors on VirusTotal, appears on one security blocklist, and was included in a single threat intelligence pulse on a major threat exchange platform. The domain’s creation date, combined with its rapid inclusion in security feeds, suggests a short-lived but targeted operation. Current status indicates fawstcup.com has been taken offline, likely due to enforcement actions by security providers. While the immediate threat is neutralized, residual risk remains for organizations that have not implemented protective measures. Defenders are advised to block the domain and associated IP address 188.114.97.3 at the network perimeter, update endpoint protection signatures, and monitor for any attempts to re-register or re-host the domain. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available.