sasha-cat[.]entrance-cryptolist[.]com

Analysis performed on July 29, 2026 identifies sasha-cat.entrance-cryptolist.com as an active generic phishing infrastructure with an elevated risk rating. The domain was registered on June 17, 2024 through Key-Systems GmbH and is hosted on Cloudflare nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, an address belonging to the Cloudflare network, a common hosting choice for malicious actors seeking rapid deployment and mitigation of takedown requests.

VirusTotal scans show that 16 of 91 security vendors have flagged the domain, indicating a measurable consensus of malicious behavior across multiple detection engines. The domain is presently listed on a single security blocklist and is actively blocked by the PhishDestroy service, reinforcing the view that it is being used in phishing campaigns. No additional public intelligence such as page title, SSL certificate details, or content snapshots is available, leaving the exact payload and targeted brands undocumented at this time.

Defenders should treat the domain as hostile: incorporate the IP and FQDN into firewall deny lists, monitor for any DNS changes that might indicate shift to alternate hosting, and ensure endpoint protection solutions are updated to reflect the current detection count. Continuous observation of threat‑intel feeds for new indicators of compromise related to sasha-cat.entrance-cryptolist.com is advised, as the lack of deeper content analysis leaves open the possibility of evolving phishing tactics targeting specific user groups.