alpaca-2[.]entry-cryptolist[.]app

Analysis of alpaca-2.entry-cryptolist.app indicates an active infrastructure used for a fake exchange phishing campaign. The domain is registered through Key-Systems LLC and resolves to the IP address 188.114.97.3, which is associated with Cloudflare, Inc. in Canada. Authoritative nameservers are fattouche.ns.cloudflare.com and liv.ns.cloudflare.com. HTTP requests return a 403 status, and the site presents a TLS certificate issued by Google Trust Services under the WE1 identifier. The domain appears on a single security blocklist and is listed by PhishDestroy. VirusTotal reports ten detections out of ninety‑four scanners, and Gridinsoft assigns a trust score of zero. The campaign employs a seed‑phrase phishing kit targeting cryptocurrency wallets, classified as a fake exchange scam. While the landing‑page content has not been disclosed, the observed indicators confirm malicious intent. Defenders should block the domain and its resolved IP at network perimeters, monitor DNS queries for the associated nameservers, and update endpoint detection rules with the observed TLS fingerprint and HTTP 403 response pattern. Continuous re‑evaluation is advised as further samples may emerge.