fstclaycrd[.]com

This domain, fstclaycrd.com, is flagged as a credential-harvesting phishing site impersonating FirstClay Credit, a financial services brand. Analysis indicates the infrastructure was designed to mimic the legitimate FirstClay Credit portal, likely to deceive users into submitting sensitive login credentials, payment details, or personal information. No specific drainer kit signatures were identified in the initial scan, but the presence of frontend libraries such as Bootstrap, jQuery, and Smartsupp suggests a polished user interface intended to enhance credibility and reduce user suspicion during the phishing attempt. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on May 18, 2025, through GMO Internet, Inc., and resolves to the IP address 213.165.249.109. VirusTotal detection metrics show 1 out of 95 security vendors flagging the domain as malicious, while Gridinsoft and Scamadviser both assigned a trust score of 1/100. The domain appears on one security blocklist, and Google Safe Browsing (GSB) status was not explicitly confirmed in available data. Detected technologies include Apache HTTP Server, jQuery UI, jQuery Migrate, Swiper, OWL Carousel, and Smartsupp, which are commonly used in both legitimate and fraudulent sites to create interactive, responsive user experiences. As of the latest assessment, fstclaycrd.com has been taken offline, reducing immediate exposure risk. However, residual threats remain due to potential credential reuse by affected users, undetected redirects, or re-registration of the domain under different infrastructure. Users who accessed the site are advised to reset credentials for any financial or personal accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Organizations should update internal blocklists with the domain and IP, and conduct retrospective log analysis to identify any prior interactions with the malicious infrastructure.