shibestee[.]entry-cryptolist[.]app

The domain shibestee.entry-cryptolist.app is currently active and has been classified as a generic phishing site with an elevated risk rating. Infrastructure analysis shows that the domain resolves to the IPv4 address 188.114.96.3. A DNS query for authoritative name servers returned no records, indicating that the domain’s NS entries are either hidden or not properly configured (NS_NOT_FOUND).

The hosting IP is listed on a single security blocklist and the domain is explicitly blocked by the PhishDestroy filtering service, confirming that at least one reputable anti‑phishing feed has identified it as malicious. VirusTotal has processed the domain, with 13 out of 91 scanning engines flagging it as malicious, reinforcing the suspicion raised by the blocklist. No additional intelligence such as registrar details, SSL certificate information, HTTP response codes, or page title has been disclosed, leaving those vectors unverified at this time.

The lack of publicly visible name‑server data and the presence on a blocklist suggest a deliberately obscured infrastructure, a common tactic used to evade passive DNS monitoring. Defenders should prioritize immediate mitigation: add the domain and its resolved IP address to network‑level deny lists, enforce URL filtering rules that include the PhishDestroy blocklist entry, and monitor outbound traffic for connections to 188.114.96.3. Continuous re‑scanning of the domain through multi‑engine services is advised to capture any changes in detection posture, and any future discovery of SSL or web‑content characteristics should be incorporated into the threat model.