eedcoin[.]entrance-cryptolist[.]com

On July 29 2026 the domain eedcoin.entrance-cryptolist.com was observed actively serving as a credential‑theft vector. The domain was registered on 17 June 2024 through the registrar Key‑Systems GmbH and is hosted on Cloudflare infrastructure, using the authoritative nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.96.3, which is a Cloudflare edge node commonly leveraged for fast‑flux style hosting. The domain appears on a single external security blocklist and has been added to the PhishDestroy blocklist, indicating that at least one reputable anti‑phishing service has confirmed malicious use.

VirusTotal analysis shows that 17 of 91 scanned security engines flagged the domain, providing independent corroboration of its malicious nature. The available intelligence does not include a published page title, SSL certificate fingerprint, or HTTP response codes, so the exact content delivered to victims remains unknown. Likewise, no public threat‑intel feeds such as OTX have been cited for this indicator, and the limited blocklist presence suggests that broader community awareness may still be developing. Nevertheless, the combination of recent registration, Cloudflare‑based hosting, and multiple vendor detections classifies the infrastructure as high‑confidence phishing infrastructure.

Defenders should prioritize blocking eedcoin.entrance-cryptolist.com at DNS and proxy layers, add the associated IP address 188.114.96.3 to network deny lists, and monitor for outbound connections to the Cloudflare edge node. Security operations teams should also include the domain in email‑filtering rules and threat‑intel feeds to capture any emerging phishing campaigns that reuse the same infrastructure. Continuous re‑evaluation is advised, as additional indicators such as page content or new vendor detections may surface.