usacoin-ethereum[.]entry-cryptolist[.]app

Analysis of usacoin-ethereum.entry-cryptolist.app indicates an active crypto‑drainer operation targeting Ethereum users. Infrastructure checks show the domain resolves to the IPv4 address 188.114.96.3; a DNS query for authoritative name servers returned no records, suggesting either a misconfiguration or the use of concealed name‑server infrastructure. The domain is listed in the PhishDestroy blocklist and appears on an additional security blocklist, confirming that at least two independent threat‑intelligence sources have flagged it as malicious.

VirusTotal reporting shows 16 of 91 scanning engines flag the domain, providing a modest but notable detection rate across commercial scanners. No further public data such as SSL certificate details, HTTP status codes, page title, or WHOIS registration information is available in the current intelligence set, leaving those aspects unverified. Risk level is elevated and the status remains active, indicating ongoing malicious activity.

Defenders should immediately add usacoin-ethereum.entry-cryptolist.app to DNS and URL filtering policies, block outbound connections to 188.114.96.3, and monitor network logs for any attempts to resolve or contact the domain. Continuous re‑scanning of the host and periodic checks of the IP reputation are advised, as the infrastructure could be repurposed for additional campaigns. Organizations that handle cryptocurrency transactions should enforce strict controls on outbound traffic to unknown domains and consider sandboxing any user‑initiated requests that involve Ethereum wallet addresses or private‑key inputs.