kalp-network[.]entrance-cryptolist[.]com

Analysis of kalp-network.entrance-cryptolist.com shows a newly created domain (registered on 2024-06-17) that is actively used for phishing. The domain resolves to the IPv4 address 188.114.96.3 and is hosted on Cloudflare’s network, as indicated by its authoritative name servers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. Registration was performed through Key-Systems GmbH, a registrar commonly associated with bulk registrations. The domain appears on a single security blocklist and is listed by PhishDestroy as a malicious entry, confirming that defensive feeds have identified it as a phishing source.

VirusTotal has recorded 15 positive detections out of 91 scanned security engines, reinforcing the malicious classification. The elevated risk rating aligns with the observed detection density and the fact that the site is currently marked as active. No publicly available page title or content analysis is present, so the exact lure or credential‑harvesting technique remains unknown.

Defenders should add 188.114.96.3 to network‑level blocklists, enforce DNS filtering for kalp-network.entrance-cryptolist.com, and monitor Cloudflare‑associated name servers for similar patterns. Continuous re‑scanning on VirusTotal or comparable sandboxes is advised to capture any evolving payloads. Organizations should educate users about unsolicited communications that reference “entrance‑cryptolist” or similar phrasing, as these are likely vectors for credential theft.