fartclup[.]com

This domain, fartclup.com, is flagged as a fake login phishing portal designed to harvest user credentials. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used to mimic legitimate authentication pages. No specific brand impersonation has been confirmed, but the infrastructure aligns with credential-theft campaigns targeting generic login interfaces. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusual future date that may indicate registry manipulation or typo-squatting tactics. It resolves to the IP address 104.21.39.91, a Cloudflare-associated endpoint commonly used to obfuscate malicious infrastructure. The domain appears on one security blocklist and has been flagged by 6 of 95 security vendors on VirusTotal, with detection labels including phishing and fraudulent credential harvesting. No historical DNS records indicate prolonged operational use, suggesting a short-lived campaign. Current status confirms the domain is offline, though residual risk remains due to potential re-activation or migration to similar infrastructure. Organizations are advised to block the domain and associated IP (104.21.39.91) at the perimeter firewall and email gateway levels. Security teams should review logs for connections to fartclup.com or its resolved IP, particularly from endpoints exhibiting anomalous authentication attempts. User awareness training should emphasize verification of login page URLs, especially for generic or unfamiliar portals. Monitoring for newly registered domains under the same registrar (NICENIC INTERNATIONAL GROUP CO., LIMITED) is recommended to preempt similar threats.