grand-theft-ape[.]entry-cryptolist[.]app

This investigation documents the infrastructure and detection profile of grand-theft-ape.entry-cryptolist.app, which is currently classified as a generic phishing site with an elevated risk rating. The domain resolves to the IPv4 address 188.114.97.3, indicating that the hosting provider is reachable on the public internet. No authoritative nameserver records were returned; the query for nameservers resulted in NS_NOT_FOUND, which limits visibility into the domain's DNS management and suggests possible use of dynamic or obscured name services.

The domain has been listed by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that at least two independent threat‑intelligence feeds are actively filtering traffic to the host. VirusTotal analysis shows that thirteen out of ninety‑one scanning engines have flagged the domain as malicious, providing a modest but notable consensus among antivirus and URL‑reputation services. The overall detection signal, combined with the active status and elevated risk level, supports a high confidence that the domain is being used for phishing attempts.

However, the absence of publicly disclosed registrar information, SSL certificate details, HTTP response codes, and page‑title metadata leaves gaps in the full threat picture; further passive and active probing would be required to ascertain the exact payload and any credential‑harvesting mechanisms employed. Defenders should immediately block the domain and its associated IP address at network perimeters, add the host to internal URL filtering lists, and monitor for any related DNS queries or outbound connections. Continuous re‑evaluation is advised, as additional detections or changes in the hosting environment could alter the threat posture.