covalent-x[.]entrance-cryptolist[.]com

Analysis completed on July 29, 2026 identifies covalent-x.entrance-cryptolist.com as an active high‑risk phishing infrastructure. The domain was registered on June 17, 2024 through Key-Systems GmbH and is hosted on the IPv4 address 188.114.96.3. DNS resolution is served by Cloudflare nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com, indicating the use of a reputable CDN for concealment. HTTP requests return a 200 OK status, confirming that the web service is reachable and currently serving content.

VirusTotal scans show that 17 of 91 security vendors flag the domain, providing multi‑engine consensus of malicious behavior. The domain appears on a single external security blocklist and is actively blocked by the PhishDestroy filtering service, demonstrating that at least one commercial feed has classified it as malicious. No additional public intelligence such as Safe Browsing or OTX references were supplied, so the full scope of the phishing campaign remains partially undocumented.

Defenders should add the domain and its resolved IP 188.114.96.3 to deny‑list controls, enforce DNS‑level blocking, and consider sinkholing traffic to monitor potential victim interaction. Continuous re‑query of reputation services is advised, as the domain may propagate additional indicators or be repointed to new infrastructure. Given the confirmed phishing classification and the observed vendor consensus, the domain should be treated as a confirmed threat and remediated accordingly.