stau[.]entry-cryptolist[.]app

Analysis of the domain stau.entry-cryptolist.app indicates active generic phishing infrastructure as of July 29, 2026. The domain resolves to the IP address 188.114.96.3, which is the sole hosting endpoint observed. It appears on one security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one defensive product has classified the host as malicious. VirusTotal data shows that 16 of 91 security vendors have flagged the domain, providing modest but consistent detection across independent scanners.

Nameserver information could not be retrieved, as the query returned NS_NOT_FOUND, limiting insight into the domain’s registration hygiene. No additional public indicators such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts were available at the time of analysis. Consequently, the observable evidence is confined to the DNS resolution, blocklist presence, and vendor detection count.

Defenders should consider immediate network-level blocking of the IP 188.114.96.3 and the domain stau.entry-cryptolist.app, incorporate the domain into URL filtering policies, and monitor for any related traffic patterns. Continuous re‑evaluation is recommended, as further intelligence—such as page content or certificate metadata—may emerge and refine the risk posture. Organizations using threat‑intel platforms should ingest the 16/91 detection signal to improve automated detection rules and ensure that endpoint protection products are updated with the latest indicator set.