ztx[.]entry-cryptolist[.]app

This domain, ztx.entry-cryptolist.app, is currently flagged as an active cryptocurrency-related phishing site. Analysis indicates elevated risk due to multiple detection signals and infrastructure anomalies. As of July 29, 2026, the domain is resolved to IP address 188.114.96.3, which lacks associated nameserver records, a configuration often observed in ephemeral phishing campaigns. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy, a specialized anti-phishing service.

VirusTotal analysis reveals that 15 out of 91 security vendors classify this domain as malicious, though the specific detection labels and methodologies vary. No registrar or hosting provider details are currently available, limiting attribution. The absence of nameserver records suggests either misconfiguration or deliberate obfuscation, a tactic frequently employed to evade takedown efforts. The resolved IP address does not provide additional context, as it may be part of a content delivery network or shared hosting environment.

Defenders should treat this domain as a confirmed phishing threat, particularly targeting users in cryptocurrency-related activities. The exact content of the site remains unanalyzed, but the combination of detection vendor flags, blocklist inclusion, and infrastructure irregularities warrants immediate blocking at the network and endpoint levels. Organizations are advised to monitor for connections to this domain and investigate any associated internal alerts. Further analysis of HTTP headers, SSL certificates, and page content could yield additional indicators, but current evidence is sufficient to classify this as an active threat.