fafscup[.]com

The domain fafscup.com, imitating the brand FASTCUP with a focus on CS2 gaming, was flagged by PhishDestroy on the day of its creation, March 27, 2026. Despite being taken offline, it was identified as malicious by one out of 94 vendors on VirusTotal. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted by Cloudflare, Inc., with an IP address located in Canada.

The phishing operation targeted Counter-Strike 2 players, leveraging the popularity of the game to lure victims. The page's title, "FASTCUP — Пусть к Серьезным победам в CS2!", suggests a promise of serious victories in CS2, likely a tactic to entice users into engaging with the site. The domain's SSL certificate was issued by Google Trust Services, adding a layer of perceived legitimacy to the unsuspecting user.

PhishDestroy's early detection highlights the importance of rapid identification in the lifecycle of phishing domains. The domain's presence on only one public blocklist underscores the challenge of catching such threats before they propagate widely. This case exemplifies the critical window between domain registration and broader antivirus detection, where proactive threat intelligence can mitigate potential harm.