zenix[.]entry-cryptolist[.]app

Analysis of the domain zenix.entry-cryptolist.app indicates an active cryptocurrency credential phishing campaign as of July 29, 2026. The domain is flagged by 15 of 91 security vendors on VirusTotal, a detection rate that suggests elevated risk for credential harvesting targeting cryptocurrency users. It appears on one security blocklist and is specifically blocked by PhishDestroy, reinforcing its classification as malicious infrastructure. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, though no autonomous system or geolocation details are currently available for further attribution.

The domain lacks configured nameservers, a common tactic to obscure ownership and reduce takedown efficiency, though this also limits operational resilience. No registrar, SSL certificate details, or HTTP response data are provided in available intelligence, leaving aspects of the hosting environment unverified. The absence of Safe Browsing or Open Threat Exchange (OTX) references does not indicate safety, as detection coverage varies across platforms.

Defenders should treat this domain as high-risk for cryptocurrency-related phishing, particularly given the 'entry-cryptolist' subdomain pattern, which aligns with known credential theft operations targeting wallet or exchange users. Network-level blocking of 188.114.97.3 and the domain itself is recommended, alongside monitoring for related subdomains under entry-cryptolist.app. Further analysis of the page content is required to confirm the exact phishing kit or targeted platform, but current evidence supports immediate defensive action.