arcadiaos[.]entrance-cryptolist[.]com

SOC analysts with ThreatIntel seed 408436 flag arcadiaos.entrance-cryptolist.com as an ACTIVE cryptocurrency-wallet phishing page under formal investigation. The landing serves no legitimate purpose and is engineered to harvest seed phrases, private keys, or wallet credentials from unsuspecting users of online crypto-storage services. Because the infrastructure is still young and the page is not yet widely blacklisted, the risk tier remains under_investigation while deeper pivoting and takedown engagements proceed. This domain was flagged with VirusTotal score of 0 detections on 95 scanners, Google Trust Services TLS certificate, and single IPv4 188.114.96.3. Historical DNS records lack prior associations, suggesting a first-seen domain registered within the last 90 days. There are zero listings on blocklists such as OpenPhish, PhishTank, URLVoid, or Google Safe Browsing as of this advisory. WHOIS shows privacy-protected registrant details and Cloudflare as registrar. Mitigation must prioritize blocking the exact domain and its resolving IP at DNS and perimeter layers. Users should avoid visiting arcadiaos.entrance-cryptolist.com and treat any unsolicited wallet-authentication prompts referencing this domain as malicious. If leveraged in spear-phishing, immediately revoke exposed seed phrases, rotate wallets, and perform cold-storage audits. Incident responders should log the SHA-256 TLS certificate fingerprint and the ASN hosting 188.114.96.3 to hunt for related C2 nodes. A formal takedown request has been lodged with the registrar and hosting provider, and the IOC package has been disseminated to industry ISAC partners via seed 408436.