xtta[.]entrance-cryptolist[.]com

xtta.entrance-cryptolist.com was registered on 17 June 2024 through the Key-Systems GmbH registrar. The domain is served using Cloudflare’s DNS infrastructure, listed under the authoritative nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com, and resolves to the IPv4 address 188.114.96.3. VirusTotal reports that 17 of 91 scanned security vendors have flagged the domain as malicious, indicating a moderate detection rate across multiple analysis engines.

The domain is currently listed on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service, confirming that it is being treated as a phishing threat by at least one commercial protection platform. Safe Browsing and Open Threat Exchange have not published entries for this domain, and no SSL certificate or HTTP status information is presently available, limiting the ability to assess transport security. Publicly available intelligence does not include a page title or any observed brand impersonation, so the exact content and targeted victim profile remain unverified.

The lack of additional context suggests that the campaign may be in an early deployment stage or that automated crawlers have not yet captured the landing page. Defenders should continue to monitor the domain for changes in reputation scores, add the host to existing URL filtering policies, and consider enforcing block rules for the resolved IP address 188.114.96.3. Given the observed detections and blocklist presence, organizations should treat any email or web traffic referencing this domain as high‑risk and quarantine or reject such communications pending further analysis.