oracle-3[.]entrance-cryptolist[.]com

The domain oracle-3.entrance-cryptolist.com was registered on June 17, 2024 through Key-Systems GmbH and is currently using Cloudflare name servers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is the sole host observed for this indicator. The domain has been listed by PhishDestroy and appears on one additional security blocklist, confirming that at least two independent threat‑intelligence feeds consider it malicious.

VirusTotal analysis shows that 15 of 91 security vendors flag the domain, providing a modest but notable detection rate that aligns with its classification as a generic phishing campaign. The threat is marked as active with an elevated risk rating as of the report date, July 29, 2026. No public SSL certificate details, HTTP status codes, page titles, or Safe Browsing verdicts are available in the current intelligence set, leaving the content of the hosted site unverified.

Consequently, defenders should prioritize blocking the domain at network perimeter devices, updating DNS deny‑lists with the observed IP and name‑server pair, and monitoring for any related traffic patterns. Additional investigation, such as retrieving the HTTP response and examining page content, would help clarify the exact phishing payload and potential credential‑harvesting mechanisms. Until such analysis is performed, the domain should be treated as a high‑confidence malicious indicator and excluded from any allow‑list configurations.