duck[.]entrance-cryptolist[.]com

Analysis of duck.entrance-cryptolist.com indicates elevated risk as a cryptocurrency-themed phishing domain. As of July 29, 2026, the domain resolves to IP address 188.114.96.3, which is associated with infrastructure previously observed in phishing campaigns. Fifteen of ninety-one security vendors on VirusTotal have flagged the domain, suggesting detection by multiple independent engines. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as malicious.

Infrastructure review reveals the domain lacks configured nameservers, a common indicator of hastily deployed or disposable phishing sites. No registrar details or registration date are provided in available intelligence, limiting attribution efforts. The absence of nameservers may also affect resolution stability, though the domain remains reachable at the time of assessment. Defenders should treat this domain as an active threat.

The combination of cryptocurrency-related terminology in the domain name, detection by multiple security vendors, and inclusion on blocklists supports its classification as a phishing resource targeting users of digital asset services. Network-level blocking of 188.114.96.3 and the domain itself is recommended for organizations with exposure to cryptocurrency or financial sectors. Further investigation into the hosting provider and associated IP range may reveal additional linked infrastructure. No brand-specific targeting or page content has been confirmed in available data, so the exact nature of the phishing lure remains unanalyzed.