clayton[.]entrance-cryptolist[.]com

Analysis of clayton.entrance-cryptolist.com was performed on 2026-07-29. The domain was registered on 2024-06-17 through Key-Systems GmbH and is hosted on Cloudflare name servers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. DNS resolution points to the address 188.114.96.3, which is currently reachable and returns HTTP 200 for the root URL, indicating an active web service. The site is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy remediation service.

VirusTotal scans show that 16 of 91 security vendors have flagged the domain as malicious, reinforcing the suspicion of phishing activity. No additional public threat intelligence sources such as OTX or Safe Browsing entries were provided, and the page title or any brand references have not been disclosed, limiting insight into the specific lure employed. The combination of recent registration, Cloudflare infrastructure, active HTTP response, and multi‑vendor detection suggests a purposeful phishing campaign that is still operational.

Defenders should add 188.114.96.3 to network‑level deny lists, enforce DNS filtering for clayton.entrance-cryptolist.com, and monitor for any new indicators that may appear in security feeds. Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture potential payload evolution. Because the domain is already blocked by PhishDestroy, organizations using that service will have automatic protection, but independent security platforms should replicate the block to ensure coverage.