farting-unicorn[.]gate-cryptolist[.]com

Analysis of the domain farting-unicorn.gate-cryptolist.com shows multiple indicators of malicious activity. The domain was registered on June 17, 2024 through Key-Systems GmbH, a registrar frequently used by threat actors. It resolves to the IP address 188.114.97.3 and uses Cloudflare nameservers (dale.ns.cloudflare.com and vera.ns.cloudflare.com), a pattern commonly observed in phishing infrastructure to provide anonymity and resilience.

The domain appears on a security blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing source has classified it as hostile. VirusTotal has scanned the domain and 14 of 91 security vendors flagged it, indicating a non‑trivial detection consensus across multiple engines. No additional public data such as Safe Browsing status, OTX tags, SSL certificate details, HTTP response codes, or page title have been disclosed, leaving the exact content and lure technique unverified.

Defenders should treat the domain as unsafe: add the domain and its resolving IP to outbound and inbound blocklists, monitor DNS queries for the Cloudflare nameservers, and consider heightened scrutiny of any traffic to the associated IP range. Continuous re‑evaluation is advised to capture any future changes in detection scores or new intelligence that may clarify the specific phishing payload or target brand.