american-bitcoin[.]entry-cryptolist[.]app

The domain american-bitcoin.entry-cryptolist.app is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Bitcoin brand. Infrastructure analysis shows the domain is registered through Key-Systems LLC and resolves to the Cloudflare‑managed IP address 188.114.97.3, with authoritative nameservers fattouche.ns.cloudflare.com and liv.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 root, yet HTTP requests return a 403 status code, indicating intentional denial of access or a protective block. Threat intelligence sources have recorded the domain on a single security blocklist and note that PhishDestroy has already blocked it. VirusTotal scans report that 10 of 94 security vendors flag the domain, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The campaign employs a Seed Phrase Phishing kit, a known method for extracting cryptocurrency recovery information. While the current evidence confirms the domain’s malicious intent, the exact content served to victims remains unverified. Defenders should add the domain and its resolving IP to blocklists, monitor DNS queries for the associated nameservers, and treat any traffic to the site as hostile. Continuous observation is advised to detect any changes in hosting or content that could affect mitigation strategies.