cipher-protocol[.]entry-cryptolist[.]app

The domain cipher-protocol.entry-cryptolist.app is currently active and has been classified as a generic phishing site with an elevated risk rating. Infrastructure analysis shows the domain resolves to the IPv4 address 188.114.96.3. No authoritative nameserver records were returned during DNS queries, indicating that the domain’s nameserver configuration is either hidden or not properly registered.

VirusTotal has logged 14 of 91 security vendors flagging the domain as malicious, providing modest consensus among scanning engines. The domain is listed on a single public security blocklist and is explicitly blocked by the PhishDestroy filtering service, demonstrating that at least one commercial mitigation product recognizes it as a threat. The combination of a detectable malicious payload, limited blocklist coverage, and a concealed nameserver setup suggests a low‑profile infrastructure designed to evade broad discovery while still reaching targeted victims.

Uncertainty remains around the specific phishing kit, the content hosted at the address, and the geographic origin of the hosting provider, as no additional metadata such as SSL certificates, page titles, or registrar details are available. Defenders should add the IP address 188.114.96.3 to outbound and inbound deny lists, enforce DNS blocking for the domain, and monitor network traffic for connections to this host. Continuous re‑evaluation is recommended to capture any changes in the domain’s detection count, blocklist presence, or hosting configuration.