xetra-ai[.]entry-cryptolist[.]app

Analysis indicates that the domain xetra-ai.entry-cryptolist.app is currently active and classified as a generic phishing threat with an elevated risk rating. The domain resolves to the IP address 188.114.96.3, which is the sole hosting indicator available. No nameserver information could be retrieved, and the domain does not appear in public DNS records beyond the resolved IP.

Reputation data show that the domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal has processed the domain and 14 of 91 security vendors have flagged it, confirming malicious intent. No additional intelligence such as Safe Browsing status, Open Threat Exchange entries, registrar details, SSL certificate information, HTTP response codes, trust scores, page titles, or evidence links were supplied.

Consequently, the full scope of the phishing campaign, including targeted brands or credential collection pages, remains undetermined. Defenders should add the domain to firewall and proxy deny lists, monitor outbound connections to 188.114.96.3, and ensure that endpoint protection solutions incorporate the latest blocklist updates that contain this indicator. Given the active status and elevated risk rating, proactive network-level blocking and user awareness messaging are recommended to mitigate potential credential harvesting attempts.