fadtcup[.]com

The domain fadtcup.com has been identified as a credential theft phishing site targeting users through deceptive login portals. Analysis indicates the domain is currently offline, though it previously hosted infrastructure designed to harvest sensitive authentication credentials, including usernames, passwords, and potentially multi-factor authentication tokens. No specific brand impersonation has been confirmed, but the site’s structure aligns with broad credential harvesting campaigns observed in recent months. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusually future-dated creation that may indicate domain spoofing or registrar data manipulation. It resolved to the IP address 188.114.97.3, a host with no prior association to legitimate services. Detection metrics show the domain was flagged by 4 of 95 security vendors on VirusTotal, while appearing on a single security blocklist. These figures suggest limited but targeted detection, likely due to the domain’s short-lived operational window or evasion techniques employed by the threat actor. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a latent threat, as the domain could be reactivated or repurposed for future campaigns. Organizations are advised to proactively block the domain and its associated IP (188.114.97.3) at the network perimeter. Users who may have interacted with the site should rotate credentials for any accounts accessed during the exposure window. Continuous monitoring of registrar activity for this domain is recommended, given the anomalous creation date and potential for re-emergence.