x-mail[.]entry-cryptolist[.]app

Analysis of x-mail.entry-cryptolist.app indicates that the domain is actively being used for phishing. The domain resolves to the IPv4 address 188.114.97.3; DNS queries return no nameserver records, suggesting either a misconfiguration or an attempt to hide hosting details. The IP is not associated with a known legitimate service and appears on a single security blocklist. VirusTotal has recorded 15 positive detections out of 91 scanned scanners, confirming malicious intent.

The feed PhishDestroy also lists the domain as blocked, reinforcing the assessment. The threat is classified as generic phishing and the risk rating is elevated, with the current operational status marked as active. Publicly available intelligence does not include registrar information, SSL certificate details, HTTP response codes, or Safe Browsing verdicts, leaving those aspects unverified. No page title or brand targeting data have been published, so the specific luring technique remains unknown.

The lack of nameserver records and limited blocklist presence may indicate recent deployment or an attempt to evade typical DNS‑based controls. Defenders should immediately block traffic to 188.114.97.3 and add x-mail.entry-cryptolist.app to domain‑based deny lists. Continuous monitoring of the IP address for new associations is advised, as well as periodic re‑scanning with VirusTotal or similar multi‑engine services to capture any changes in detection scores. Incorporating the domain into internal phishing‑email filters and sharing the indicator with upstream threat‑intelligence platforms will help contain the campaign while additional forensic analysis of the landing page is conducted.