marionawfal-on-x[.]entry-cryptolist[.]app

The domain marionawfal-on-x.entry-cryptolist.app is currently flagged as an active generic phishing infrastructure. Infrastructure analysis shows the domain resolves to the IPv4 address 188.114.97.3. The host is listed on a single security blocklist and is actively blocked by the PhishDestroy service, indicating that at least one downstream protective system has identified malicious intent.

VirusTotal reports that 14 out of 91 scanning engines have classified the domain as malicious, providing a modest but notable consensus of detection across multiple vendors. The domain’s authoritative name server information could not be retrieved, as the records return NS_NOT_FOUND, limiting visibility into the registration details and complicating attribution efforts. No additional telemetry such as page title, SSL certificate details, or HTTP response codes is presently available, leaving the exact content and lure mechanisms unverified.

Defenders should continue to block the domain at perimeter and endpoint layers, monitor DNS queries for the address 188.114.97.3, and consider adding the domain to internal blocklists. Ongoing threat intelligence collection is recommended to capture any future changes in hosting, name server configuration, or observed payloads that may augment the current evidence base.