original-gangsters[.]entry-cryptolist[.]app

Analysis of the domain original-gangsters.entry-cryptolist.app indicates active malicious activity consistent with generic phishing. The domain has been explicitly blocked by the PhishDestroy mitigation service, demonstrating that at least one security vendor has identified it as a phishing vector. DNS resolution points to the IP address 188.114.96.3; no authoritative nameserver records were returned during the lookup, which prevents verification of the domain’s hosting infrastructure and may be an intentional evasion technique.

VirusTotal scans show that 15 of 91 security engines flagged the domain, providing moderate consensus of malicious intent despite the majority of engines returning a clean verdict. The domain also appears on a single external blocklist, further corroborating its reputation as a threat. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or brand targeting is available at this time, leaving the exact phishing campaign content and lure mechanism undefined.

Given the confirmed block by PhishDestroy, the presence on a blocklist, and the VirusTotal detection rate, defenders should treat the domain as high‑risk. Recommended mitigations include immediate DNS or proxy level blocking of the domain and the associated IP address, inclusion of the indicator in intrusion detection signatures, and continuous monitoring for any changes in detection scores or additional blocklist listings. Organizations should also consider reviewing outbound traffic for connections to 188.114.96.3 and enforce strict email filtering to prevent phishing emails that reference this domain from reaching end users.