idn[.]farmcash[.]life

The domain idn.farmcash.life was registered on March 12, 2026 through NameCheap, Inc. and resolves to the Cloudflare IP address 104.21.0.193, which is associated with AS13335 Cloudflare, Inc. The authoritative nameservers are carlane.ns.cloudflare.com and alfred.ns.cloudflare.com, indicating that the site leveraged Cloudflare's CDN and security services. Network analysis shows the site served content over HTTP/3 and employed Vue.js as the front-end framework, confirming modern web technology usage. The SSL certificate presented by the server is issued by Google Trust Services under the WE1 designation, providing a valid TLS handshake and suggesting the use of Google-managed certificates for encryption.

Public threat intelligence records list the page title as "Kekayaan Robot," and the site has been classified as an investment‑type scam within the generic phishing category. VirusTotal scanned the domain and recorded a single positive detection out of 94 security vendors, demonstrating that at least one vendor identified malicious behavior. The domain appears on one external security blocklist and has been specifically blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, reflecting a highly suspicious reputation. The site’s current status is offline, but the historical evidence remains relevant for defensive controls.

Defenders should continue to block idn.farmcash.life at the network perimeter, update URL filtering and DNS sinkhole lists to include the associated IP 104.21.0.193 and the domain itself, and monitor for any re‑registration attempts. Given the Cloudflare hosting, alerts based on rapid changes to DNS records or nameserver configurations could indicate a resurgence. Endpoint protection platforms should consider the single VirusTotal detection as a signal to flag any execution attempts linked to resources fetched from this domain.