marvin-the-martian[.]entry-cryptolist[.]app

Analysis of marvin-the-martian.entry-cryptolist.app shows that the domain resolves to the IPv4 address 188.114.96.3, indicating a single‑host deployment that is publicly reachable. The authoritative nameserver query returns NS_NOT_FOUND, suggesting that the domain either lacks properly configured DNS delegation or is deliberately obscuring its name server information to hinder attribution. VirusTotal reports that 14 of 91 security vendors have flagged the domain, providing independent confirmation that malicious activity is associated with the host.

The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy feed, reinforcing the consensus that it is being used for phishing‑related abuse. No additional intelligence such as page title, SSL certificate details, or HTTP response codes is available, leaving the exact content and impersonated brand undefined. The limited data set nevertheless establishes a clear malicious profile: the domain is actively serving a phishing payload, is identified by multiple vendors, and is already being mitigated by at least one commercial blocklist.

Defenders should block the domain at network perimeter devices, update DNS sinkhole lists, and add the IP address 188.114.96.3 to host‑based deny lists. Continuous monitoring of the host for changes in DNS configuration, additional vendor detections, or new blocklist entries is recommended to capture any evolution of the campaign.