first-bitcoin-atm[.]entry-cryptolist[.]app

Analysis on first-bitcoin-atm.entry-cryptolist.app indicates that the domain resolves to the IPv4 address 188.114.96.3. The hosting IP is shared with other malicious artifacts observed in recent threat feeds, suggesting a reusable infrastructure. The domain is listed on a single public security blocklist and has been actively blocked by the PhishDestroy feed, confirming its presence in operational phishing campaigns. VirusTotal scans show that 11 of 91 antivirus and URL‑reputation engines have flagged the URL as malicious, providing independent corroboration of its threat profile.

No public registrar information, SSL certificate details, HTTP status codes, or page title have been disclosed in the current intelligence set, leaving those vectors unverified. Likewise, Safe Browsing, OTX, and other reputation services have not published explicit verdicts for this host at this time. The absence of these data points does not imply benign intent; it reflects a gap in the collection pipeline that should be addressed. Defenders should prioritize immediate containment by adding first-bitcoin-atm.entry-cryptolist.app to DNS block lists, web‑proxy deny lists, and endpoint URL filtering rules.

Because the domain resolves to 188.114.96.3, network‑level controls may also block traffic to that IP, though caution is advised to avoid collateral impact on legitimate services sharing the address. Continuous monitoring of the IP and associated hostnames is recommended, as threat actors frequently repurpose the same hosting resources for new campaigns. Security teams should also query passive DNS feeds for historic resolutions and watch for future registrations that reuse the same name pattern or IP block. Finally, the relatively low detection count on VirusTotal suggests that some security products have not yet incorporated the indicator; updating AV definitions and ensuring URL‑reputation feeds are current will improve detection coverage.