healix-ai[.]entry-cryptolist[.]app

On July 29, 2026 the domain healix-ai.entry-cryptolist.app was flagged by multiple threat‑intelligence sources. VirusTotal records show that 14 of 91 scanning engines have classified the host as malicious, providing a clear multi‑engine consensus of compromise. DNS queries return no name‑server information (NS_NOT_FOUND), a condition that hampers conventional verification and often accompanies fast‑flux or dynamically re‑registered infrastructure.

The domain resolves to the IPv4 address 188.114.97.3, which is currently listed on the PhishDestroy blocklist and appears on one additional public security blocklist, indicating that the IP is already recognized as a source of credential‑harvesting activity. No SSL/TLS details, HTTP status codes, or page‑title metadata are present in the available dataset, so the exact payload, targeted brand, or phishing kit remains unconfirmed. This lack of observable web‑layer characteristics reinforces the classification as a generic credential‑stealing endpoint rather than a site tied to a specific brand or service.

Analysts should treat the indicator with an elevated risk rating and apply defensive controls accordingly. Recommended actions include adding both the fully qualified domain name and its resolving IP to outbound filtering and DNS sinkhole policies, monitoring network logs for any connections to 188.114.97.3, and regularly re‑querying the domain for changes in name‑server records, TLS certificates, or page content. Organizations that ingest threat feeds should correlate this indicator with internal telemetry to identify potential exposure and update incident‑response playbooks to cover credential‑theft scenarios involving this subdomain family.