agent-s[.]entrance-cryptolist[.]com

This domain, agent-s.entrance-cryptolist.com, is flagged as a crypto credential theft operation designed to harvest wallet logins, private keys, and seed phrases. Analysis indicates the infrastructure mimics legitimate cryptocurrency portal entry points, likely leveraging social engineering to deceive users into disclosing sensitive authentication details. No specific drainer kit signatures were identified, but the domain exhibits characteristics consistent with credential harvesting campaigns targeting decentralized finance (DeFi) and wallet users. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 17, 2024, through Key-Systems GmbH and resolves to the IP address 188.114.96.3. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and was actively blocked by at least one threat intelligence feed prior to takedown. No Google Safe Browsing (GSB) records were found at the time of analysis, suggesting limited initial visibility or evasion techniques. The domain is currently offline, having been taken down following detection and reporting. While no active threat remains, residual risk persists for users who may have interacted with the domain during its operational window. Organizations and individuals are advised to monitor wallet transactions for unauthorized activity, revoke any connected dApp permissions, and rotate credentials if exposure is suspected. Network-level blocking of the IP 188.114.96.3 and domain-based filtering are recommended to prevent potential re-emergence or related infrastructure reuse.