claim[.]fartdev[.]app

This domain, claim.fartdev.app, was observed as part of a brand‑impersonation campaign targeting the cryptocurrency data platform coingecko. The site was registered on 21 February 2026 and subsequently resolved to the IPv6 address 2606:4700:3035::ac43:c493, which belongs to AS13335, operated by Cloudflare, Inc., located in the United States. The TLS certificate presented on the host is identified as WE1, indicating a standard Cloudflare‑issued certificate without additional validation. The page title returned from the server reads “Fartcoin ‑ Airdrop”, matching the pattern of an airdrop‑style crypto scam kit that has been linked to the “Airdrop Scam” phishing kit family. During the investigation the domain was listed on two independent security blocklists, and both PhishDestroy and ScamSniffer have recorded it as blocked.

VirusTotal analysis shows that three of ninety‑three scanning engines flagged the domain, suggesting a low but present detection footprint. The Gridinsoft trust score of zero out of one hundred reinforces the classification as malicious. The campaign’s risk level has been assessed as elevated, and the domain status is currently offline, indicating that the malicious content has been removed or the hosting has been terminated. Evidence confirms the use of a crypto‑focused social engineering lure, but the exact content served before takedown remains unverified.

No additional infrastructure, such as command‑and‑control servers or secondary domains, has been identified in the available data. Defenders should continue to monitor the IPv6 address and the Cloudflare ASN for any re‑use, enforce blocklist updates that include this domain, and consider adding the associated IP range to network‑level deny lists. Organizations that integrate coingecko services should educate users about unsolicited airdrop offers and verify URLs against the official coingecko domain.