national-digital-asset-stockpile[.]entrance-cryptolist[.]com

national-digital-asset-stockpile.entrance-cryptolist.com was registered through Key-Systems GmbH on 17 June 2024. The domain is hosted on Cloudflare infrastructure, using the authoritative nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com, and resolves to the IP address 188.114.96.3. VirusTotal reports that 17 of 91 scanning engines have flagged the domain as malicious, indicating a moderate level of consensus among security vendors.

The domain appears on a single public blocklist and is actively listed by the PhishDestroy mitigation service, confirming that at least one anti‑phishing provider has taken enforcement action. The available metadata does not include SSL certificate details, HTTP response codes, page title, or any observed brand targeting, so the exact content of the site remains unverified. Nevertheless, the combination of recent registration, Cloudflare hosting, and multiple vendor detections aligns with typical patterns of generic credential‑harvesting campaigns.

Defenders should prioritize adding the domain to DNS‑based blocklists and network firewalls, monitor traffic to the associated IP address for anomalous connections, and consider extending existing phishing‑filter rules to cover the entrance‑cryptolist.com sub‑domain space. Continuous re‑evaluation is advised, as further analysis of the landing page could reveal additional indicators such as malicious scripts or exfiltration endpoints.