rwa-inc[.]entrance-cryptolist[.]com

Analysis of rwa-inc.entrance-cryptolist.com indicates that the domain is actively being used for a generic phishing campaign. The domain was registered through Key-Systems GmbH on June 17, 2024 and is currently resolved to the IP address 188.114.96.3, which belongs to Cloudflare’s network and is served by the authoritative nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. On VirusTotal the domain receives detections from 14 of 91 security vendors, demonstrating that a notable portion of scanners classify it as malicious. It appears on one external security blocklist and is specifically blocked by the PhishDestroy feed, confirming that threat‑intelligence communities have observed malicious activity tied to this name.

The risk level is marked as elevated and the status is active, suggesting ongoing use. No publicly available SSL certificate details, HTTP response codes, or page title information have been disclosed, leaving those vectors unverified. Consequently, the precise content hosted at the domain, the phishing kit employed, and the targeted brand remain unknown. Defenders should treat the domain as hostile, add it to DNS‑based blocklists, and monitor for any resolution to the Cloudflare IP range.

Network traffic to 188.114.96.3 should be logged and, if feasible, redirected to a sinkhole. Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture any evolving payloads. Organizations that employ email filtering should ensure that messages containing this domain are quarantined or rejected. Given the limited public evidence, further investigation of the hosting environment and any associated sub‑domains is advised to fully map the threat infrastructure.