fastlcp[.]com

Analysis of the domain fastlcp.com indicates it was actively involved in phishing operations targeting users of the Counter-Strike 2 (CS2) gaming platform. The domain, created on February 21, 2026, resolved to the IP address 104.21.56.160, hosted by Cloudflare, Inc. (AS13335) in the United States. The page title, 'FASTCUP — Путь к Серьезным победам в CS2!', explicitly references CS2, suggesting an attempt to lure gamers with promises of competitive advantages or rewards. The domain was registered through NiceNIC International Group Co., Limited, a registrar often associated with short-lived malicious domains. Infrastructure analysis reveals the use of Cloudflare nameservers (marek.ns.cloudflare.com and rita.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns.

The site employed Cloudflare Browser Insights and HTTP/3, technologies that may enhance performance but are also leveraged by threat actors to bypass security controls. An SSL certificate issued by Google Trust Services (WE1) was present, providing a false sense of legitimacy. Detection by PhishDestroy and a single flag from a security vendor on VirusTotal (1/93) further corroborate its malicious classification. The domain appeared on one security blocklist and was subsequently taken offline, though its prior activity remains a concern.

Defenders should treat this domain as a confirmed phishing threat targeting CS2 users. The combination of Cloudflare hosting, a gaming-themed lure, and minimal but consistent detection by security vendors underscores its elevated risk profile. Organizations are advised to block the domain and IP at perimeter security controls, monitor for related indicators of compromise (IOCs), and alert users to the potential for credential theft or malware distribution. Given the domain's recent creation and rapid takedown, similar infrastructure may re-emerge under different names, warranting proactive threat hunting.