rednote-xiaohongshu[.]entry-cryptolist[.]app

Analysis indicates that rednote-xiaohongshu.entry-cryptolist.app resolves to the IPv4 address 188.114.97.3. The host is currently listed on a single public blocklist and has been explicitly blocked by the PhishDestroy service, suggesting that it has been observed delivering phishing content. VirusTotal reports 16 of 91 scanned security engines flagging the domain as malicious, which provides independent confirmation of malicious intent. The domain’s authoritative name server records could not be retrieved (NS_NOT_FOUND), a condition often associated with fast‑flux or temporary DNS setups used to evade takedown.

No TLS certificate information, HTTP status codes, or page title data are available in the supplied intelligence, leaving the surface‑web characteristics of the site undocumented. The lack of visible SSL/TLS parameters prevents assessment of encryption usage, and the absence of a known page title means the specific brand or lure employed by the campaign cannot be confirmed. Defenders should treat the domain as high‑confidence malicious, enforce network‑level blocking, and add the IP address 188.114.97.3 to any existing deny lists.

Continuous DNS monitoring is advised to detect any future changes to the domain’s name‑server configuration or IP address. Because the domain is already flagged by multiple vendors, security tools that ingest VirusTotal or blocklist feeds will likely generate alerts; administrators should ensure those alerts trigger appropriate incident‑response actions, including isolation of affected endpoints and forensic capture of any credential submissions. Until additional telemetry such as HTTP response content or SSL certificates becomes available, the domain should remain fully blocked and excluded from user access.