the-graph[.]entry-cryptolist[.]app

The domain the-graph.entry-cryptolist.app is currently active and has been identified as a host for a Seed Phrase Phishing kit targeting users of cryptocurrency exchanges. Infrastructure analysis shows the domain resolves to IP 188.114.96.3, which is a Cloudflare‑owned address located in Canada. Both authoritative name servers are Cloudflare (fattouche.ns.cloudflare.com, liv.ns.cloudflare.com). The site presents an HTTPS certificate issued by Google Trust Services under the WE1 intermediary, indicating a valid TLS chain despite malicious intent. HTTP requests return a 403 status code, suggesting the front‑end is intentionally restricted or protected. The registration was performed through Key‑Systems LLC, and the domain carries a Gridinsoft trust score of 0/100, reflecting a high likelihood of abuse. It is listed on one security blocklist and is already blocked by PhishDestroy. VirusTotal scans have flagged the domain on 15 of 91 engines, further corroborating its malicious nature. The declared scam type is a Fake Exchange, which aligns with the Seed Phrase Phishing kit that typically harvests private keys by masquerading as a legitimate exchange login. No additional content analysis is available, so the exact landing page layout and credential capture mechanisms remain unknown. Defenders should deny any network traffic to the domain and its resolved IP, add the domain to URL filtering and threat intelligence feeds, and monitor for similar seed‑phrase phishing patterns. Continuous re‑scan of the domain with multi‑engine services is recommended to capture any evolution of the payload.