elysyn-ai[.]entry-cryptolist[.]app

Analysis of the domain elysyn-ai.entry-cryptolist.app shows that it resolves to the IPv4 address 188.114.96.3. The host is currently listed on a single public blocklist; the PhishDestroy service has added the domain to its phishing denial list. VirusTotal has recorded detections from twelve of ninety‑one scanning engines, indicating that a minority of AV engines recognize malicious activity linked to the domain. Queries for authoritative name servers returned no results, meaning NS records could not be retrieved. This absence may reflect a deliberately minimal DNS footprint or a misconfiguration that hinders further reconnaissance.

The IP address 188.114.96.3 belongs to a public hosting range that is frequently reused for short‑lived malicious campaigns. No additional information about the autonomous system number, hosting provider, or geographic location is supplied in the current intelligence set, limiting the ability to attribute the infrastructure to a specific operator. Because the domain lacks resolvable NS entries, verification of DNSSEC or other protective extensions is not possible.

At this time the exact phishing lure, associated credential‑stealing pages, and targeted brand remain unknown because no page title or content analysis has been published. Defenders should incorporate the domain into URL‑filtering and web‑proxy deny lists, and consider blocking traffic to the associated IP address as a precautionary measure. Continuous monitoring of DNS queries for newly‑issued sub‑domains that resolve to the same IP is advised, given the domain is active and already triggered multiple vendor detections. Threat‑intel feeds that reference the PhishDestroy blocklist should be polled for updates, and any future VirusTotal scans should be reviewed for changes in the detection count.