san-chan[.]entry-cryptolist[.]app

The domain san-chan.entry-cryptolist.app is currently classified as an active generic phishing site with an elevated risk rating. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which is the sole hosting endpoint observed. The domain is listed on one external security blocklist and has been explicitly blocked by the PhishDestroy sinkhole, indicating that at least one defensive network has identified malicious activity associated with this name. VirusTotal scans report that 16 of 91 security vendors have flagged the domain, providing additional independent confirmation of its malicious nature.

No additional DNS records such as nameserver details are available; the nameserver field returned NS_NOT_FOUND, suggesting that the authoritative name servers could not be resolved at the time of analysis. No public page title, SSL certificate information, HTTP status codes, or Safe Browsing verdicts have been observed, leaving the exact presentation layer and target brand undefined. Consequently, the specific lure or credential‑stealing technique employed by the site remains uncertain.

Defenders should immediately add san-chan.entry-cryptolist.app to deny lists across DNS filtering, proxy, and endpoint protection solutions. Monitoring of the associated IP address 188.114.97.3 for any outbound connections from internal hosts is recommended, as is the inclusion of the domain in threat‑intel feeds to propagate the indicator to downstream security products. Given the limited visibility into the site’s content, continuous re‑evaluation is advised; any future discovery of page characteristics, SSL fingerprints, or additional blocklist listings should be incorporated into the response posture to ensure comprehensive mitigation.