manifest-cool[.]entrance-cryptolist[.]com

The domain manifest-cool.entrance-cryptolist.com was registered through Key-Systems GmbH on 17 June 2024. DNS resolution points to the IPv4 address 188.114.96.3, which is served by Cloudflare nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. VirusTotal analysis shows that sixteen of ninety‑one scanning engines flag the domain as malicious, indicating a consensus of detection across multiple vendors. The domain is listed on a security blocklist and is actively blocked by the PhishDestroy filtering service, confirming that threat‑intelligence feeds have identified it as a phishing vector.

The single blocklist entry currently referencing the domain originates from a reputable anti‑phishing consortium, reinforcing the credibility of the detection. No public TLS certificate information or HTTP response headers have been disclosed, and the page title or landing‑page content has not been published in the available intelligence. Consequently, the specific lure or credential‑harvesting technique employed by the site cannot be described at this time. Defenders should add 188.114.96.3 to outbound‑traffic denial lists, enforce DNS‑level blocking of manifest-cool.entrance-cryptolist.com, and ensure that any email filters reference the domain hash to prevent delivery of malicious messages.

Continuous monitoring of the Cloudflare name server entries is advised, as adversaries may shift the underlying IP address while retaining the same domain registration. Organizations that rely on the affected brand’s services should educate users about unsolicited communications that reference the domain, even though the exact brand impersonated is not yet known. The elevated risk level reflects the combination of recent registration, active hosting, and the relatively high vendor detection ratio.