eduvantage-ai[.]entry-cryptolist[.]app

Analysis of eduvantage-ai.entry-cryptolist.app shows that the domain is actively used for phishing. The domain resolves to the IPv4 address 188.114.97.3, indicating a single hosting endpoint that can be targeted for network‑level mitigation. It appears on one security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that reputable anti‑phishing sources have identified malicious activity associated with this host. VirusTotal scans report that 13 of 91 security vendors flag the domain as malicious, providing independent corroboration of its threat status.

Public DNS queries return no nameserver information (NS_NOT_FOUND), suggesting that the authoritative name server records are either hidden or not properly configured, which can hinder rapid takedown but also signals an attempt to obscure infrastructure. No additional intelligence such as registrar details, SSL certificate metadata, HTTP status codes, or page title has been published in open sources, leaving those vectors unverified at this time. Defenders should prioritize adding eduvantage-ai.entry-cryptolist.app to domain blocklists across perimeter firewalls, secure web gateways, and endpoint protection solutions. The associated IP address 188.114.97.3 should be added to network‑level deny lists, and traffic to this address should be monitored for anomalous patterns that could indicate ongoing phishing campaigns.

Continuous ingestion of threat‑intel feeds, including PhishDestroy and VirusTotal updates, is recommended to capture any future re‑hosting or domain‑generation activity. Organizations should also consider implementing DNS sinkholing for the domain to prevent credential harvesting attempts. Regular re‑assessment of the domain’s status is advised, as infrastructure changes could introduce new exposure vectors.