farming-eth-usdc[.]world

Analysis as of July 29, 2026 indicates that the domain www.farming-eth-usdc.world is actively used in a social‑engineering campaign. The domain is listed on a single public blocklist and has been forcibly added to the PhishDestroy sinkhole, confirming that security operators have observed malicious activity originating from it. DNS resolution points to the IPv4 address 104.21.75.34; no authoritative name servers were returned during the query, which suggests the domain may be using a CDN or a dynamic DNS service that does not expose traditional NS records. VirusTotal has recorded detections from 12 of 91 scanning engines, a signal that multiple independent tools have identified malicious payloads or suspicious behavior associated with the host.

Google Safe Browsing classifies the site under the “social engineering” category, reinforcing the hypothesis that the domain is employed to lure victims into disclosing credentials or personal data. The available intelligence does not include a harvested page title, identified brand target, or concrete information about the phishing kit in use, leaving the exact luring technique undefined. Consequently, defenders cannot attribute the campaign to a specific brand impersonation, nor can they describe the exact user‑experience flow. The lack of visible nameserver records also hampers attribution of the underlying registrar or hosting provider.

Given the observed indicators, network defenders should immediately block traffic to 104.21.75.34 and to the fully qualified domain name www.farming-eth-usdc.world at both DNS and HTTP layers. Security appliances should be updated with the domain and IP as malicious indicators, and any existing email or web filters that rely on Google Safe Browsing or VirusTotal reputation data should be refreshed to reflect the current detections.