chromosome[.]entrance-cryptolist[.]com

Analysis of chromosome.entrance-cryptolist.com indicates that the domain is actively being used for a generic phishing campaign. The domain was registered through Key-Systems GmbH on June 17, 2024 and remains active as of the report date, July 29, 2026. DNS resolution points to the IP address 188.114.96.3, hosted on Cloudflare infrastructure with authoritative nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. An HTTP request to the domain returns a 200 OK status, confirming that a web service is reachable.

VirusTotal records show that 17 of 91 security vendors have flagged the domain, providing independent corroboration of malicious intent. The domain appears on one external security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its classification as a high‑risk phishing host. While the exact phishing landing page content has not been publicly disclosed, the combination of a recent registration, active web service, multiple vendor detections, and inclusion on blocklists supports the conclusion that the domain is being leveraged to harvest credentials or other sensitive information.

Uncertainty remains regarding the specific target brand or the exact payload delivered to victims, as no page title or brand attribution is available in the current intelligence set. Defenders should add chromosome.entrance-cryptolist.com to deny‑list and URL filtering rules, monitor outbound connections to its IP address 188.114.96.3, and enforce multi‑factor authentication for accounts that could be targeted. Continuous re‑evaluation is advised, as threat actors may alter the site content or shift hosting while retaining the same domain.