entry-cryptolist[.]app

The domain entry-cryptolist.app is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Arbitrum ecosystem. Infrastructure analysis shows the domain is registered through Cloudflare, Inc. and resolves to the IPv4 address 135.148.54.52, which belongs to AS16276 (OVH SAS) in the United States. The authoritative nameservers are fattouche.ns.cloudflare.com and liv.ns.cloudflare.com, and the site presents a valid SSL certificate issued by Google Trust Services under the WE1 authority, indicating proper TLS termination. HTTP requests return a 302 redirect, and fingerprinting tools detect the use of IPFS, Vue.js, Cloudflare services, and HTTP/3 protocol. Threat intelligence feeds corroborate the malicious nature: 18 of 95 VirusTotal scanners flag the domain, AlienVault OTX lists it in 22 separate pulses, and it appears on two public blocklists. The site has been blocked by PhishDestroy and ScamSniffer, and Gridinsoft assigns a trust score of 0 / 100. The observed page title is "CRYPTOLIST", but no further content analysis is available, leaving the exact payload or user‑interaction model uncertain. The combination of a reputable TLS certificate and a 302 redirect may be used to lure victims to a malicious landing page that harvests cryptocurrency credentials. No visual analysis of the landing page is available, so the specific phishing vector remains unknown. Given the presence of IPFS and Vue.js, the site could serve client‑side scripts that interact with blockchain wallets. Defenders should add the domain and its IP to outbound blocklists, monitor DNS queries for the associated Cloudflare nameservers, enable TLS inspection to capture the redirected content, consider sinkholing the IP address, update IDS signatures with observed protocol usage, and maintain continuous threat‑intel correlation to detect any emerging indicators tied to this infrastructure.