freeinnovgovhopethrstx[.]entry-cryptolist[.]app

freeinnovgovhopethrstx.entry-cryptolist.app is currently active and has been classified as a generic phishing infrastructure. DNS resolution points to the IPv4 address 188.114.96.3, which is the sole host observed for this domain. The domain appears on a single external blocklist and has been added to the PhishDestroy mitigation list, indicating that at least one commercial anti‑phishing service has taken active counter‑measures. VirusTotal scans have returned 13 positive detections out of 91 submitted engines, confirming that multiple independent scanners consider the site malicious.

No nameserver records are resolvable; the query for NS records returns NS_NOT_FOUND, suggesting either rapid changes in delegation or deliberate obfuscation. Other typical telemetry such as registrar details, SSL certificate information, HTTP response codes, Safe Browsing verdicts, or Open Threat Exchange (OTX) tags are not presently available in the public feed. Consequently, the full scope of the hosting environment and any associated payload delivery mechanisms remain uncertain. Analysts should prioritize adding the IP address 188.114.96.3 to network‑level deny lists and enforce domain‑based blocking for freeinnovgovhopethrstx.entry-cryptolist.app across perimeter firewalls, DNS resolvers, and endpoint protection platforms.

Continuous monitoring of threat‑intel feeds for additional sightings, changes in detection counts, or the emergence of new infrastructure components is recommended. Organizations that observe outbound connections to the listed IP or DNS queries for the domain should trigger incident response procedures, collect relevant network logs, and consider sandbox analysis if a page is retrieved. Given the existing detections and blocklist presence, the risk posture for this indicator should be treated as elevated until further remediation actions confirm its removal from the environment.