keeta[.]entry-cryptolist[.]app

The domain keeta.entry-cryptolist.app is presently listed as a generic phishing site with an elevated risk level and an active status. Public threat feeds indicate that VirusTotal has recorded 16 out of 91 scanned security vendors flagging the domain as malicious, demonstrating moderate consensus among scanners. The domain is present on a single external blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that at least one commercial anti‑phishing solution has taken enforcement action.

DNS queries resolve the hostname to the IPv4 address 188.114.96.3; authoritative name‑server data is unavailable (NS_NOT_FOUND), which limits visibility into the hosting provider, ASN, or registration details. No further telemetry such as SSL certificate fingerprints, HTTP status codes, page‑title strings, or content snapshots has been released, so the precise phishing lure, target brand, or credential‑capture mechanism remains unverified. The combination of multi‑vendor detections, blocklist inclusion, and active filtering strongly suggests that the domain is being leveraged to harvest user credentials or to deliver fraudulent requests.

Defensive recommendations include adding keeta.entry-cryptolist.app and its resolved IP 188.114.96.3 to network‑level deny lists, enforcing URL filtering at proxy or gateway devices, and configuring email security gateways to block messages containing the domain. Continuous monitoring for new indicators—such as changes in hosting infrastructure, additional blocklist listings, or emergence of SSL/TLS artifacts—is advised to adapt defenses as the threat evolves.