kiloex[.]entry-cryptolist[.]app

Analysis of the domain kiloex.entry-cryptolist.app shows that it resolves to the IPv4 address 188.114.97.3. VirusTotal has recorded 14 detections out of 91 scanned security vendors, indicating that multiple commercial scanners have identified malicious behavior associated with the host. The domain is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one dedicated anti‑phishing platform recognizes it as abusive. No authoritative nameserver records were returned (NS_NOT_FOUND), which limits the ability to verify the domain’s delegation and may be indicative of a fast‑flux or otherwise evasive hosting configuration.

No additional metadata such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts are currently available in the intelligence feed, leaving the surface‑web characteristics of the site unverified. The observable infrastructure suggests a low‑profile hosting environment that relies on a single IP address, a pattern commonly observed in short‑lived phishing campaigns. Defenders should immediately add kiloex.entry-cryptolist.app to network‑level deny lists and ensure that any endpoint protection solutions ingest the 14 vendor detections from VirusTotal.

Continuous monitoring of the hosting IP 188.114.97.3 is recommended, as the address may be reused for other malicious payloads. Because the domain lacks visible DNS delegation, periodic re‑query of nameserver information is advisable to detect any future changes that could signal a shift in the underlying command‑and‑control infrastructure. In the absence of further content‑level indicators, the precautionary approach is to treat the domain as active phishing infrastructure and to block all inbound and outbound traffic to and from the identified host.