evanthehobo-com[.]entry-cryptolist[.]app

The domain evanthehobo-com.entry-cryptolist.app is currently active and has been identified as a generic phishing infrastructure. Analysis shows that the domain resolves to the IP address 188.114.96.3, and its authoritative name servers could not be retrieved, indicating either a misconfiguration or deliberate obfuscation of DNS information. The domain has been flagged by PhishDestroy and appears on one external security blocklist, confirming that it is already recognized by at least one reputable anti‑phishing service. VirusTotal reports that 13 of 91 scanning engines have marked the domain as malicious, providing independent corroboration of its threat status.

No additional data such as SSL certificate details, HTTP response codes, page titles, or brand targeting is presently available, limiting the depth of behavioural analysis. Given the limited but consistent evidence—multiple vendor detections, blocklist inclusion, and active resolution to a public IP—defenders should treat the domain as hostile. Recommended mitigation steps include adding the fully qualified domain name to network deny lists, configuring DNS sinkholing for the associated IP address, and ensuring that any outbound traffic to 188.114.96.3 is blocked or closely monitored.

Security operations teams should also update intrusion detection signatures to flag any HTTP requests containing the domain string. Continuous monitoring of VirusTotal and other threat intel feeds is advised to capture any changes in detection counts or additional context that may emerge. Because the infrastructure details are sparse, organizations should maintain a high level of vigilance for any related indicators of compromise, especially in credential‑harvesting scenarios.