fartimus-prime[.]entrance-cryptolist[.]com

On 2026-07-29 the domain fartimus-prime.entrance-cryptolist.com was observed actively serving malicious content. The domain is currently classified as an elevated‑risk generic phishing site. Infrastructure analysis shows it resolves to the IPv4 address 188.114.96.3. No authoritative nameserver records are returned, indicating that the domain’s DNS configuration is either hidden or misconfigured. The IP belongs to a hosting provider that is frequently used by malicious actors, but no further attribution is available from the supplied data.

Reputation services have flagged the domain. PhishDestroy has added it to its blocklist, and the domain appears on one additional security blocklist. VirusTotal reports that 15 of 91 scanned scanners label the domain as malicious, confirming a consensus of detection across multiple engines. No SSL/TLS certificate details are provided, and HTTP status codes have not been disclosed, so the presence of HTTPS cannot be confirmed.

The lack of publicly visible nameserver data and the limited number of blocklist entries leave some uncertainty regarding the full scope of the campaign. Defenders should treat any traffic to the domain as hostile. Recommended mitigations include adding the domain and its resolved IP address to local deny lists, updating proxy and firewall rules to block outbound connections, and ensuring that endpoint protection solutions are configured to recognize the 15 VirusTotal detections. Continuous monitoring of the IP address for new associations and periodic re‑query of reputation services is advised to capture any changes in the threat landscape.