ftx-ai-agent[.]entry-cryptolist[.]app

Analysis as of July 29, 2026 indicates that the domain ftx-ai-agent.entry-cryptolist.app is actively being used in a generic phishing campaign. The domain resolves to the IPv4 address 188.114.97.3; no nameserver records were returned in DNS queries, which may hinder attribution of the hosting provider. VirusTotal has recorded 12 detections out of 91 scanned security vendors, demonstrating moderate consensus among scanners that the domain is malicious. The domain appears on a single external blocklist and is listed as blocked by the PhishDestroy service, reinforcing its classification as hostile.

The risk rating assigned by the reporting source is elevated, and the operational status is marked as active, suggesting ongoing malicious use. Publicly available metadata does not include a registered WHOIS record, SSL certificate details, or HTTP response codes, leaving those aspects uncertain. Absence of a disclosed page title or brand target means the exact content served by the site has not been captured in the current intelligence set. Consequently, defenders cannot rely on page‑level indicators for detection, but the presence of multiple vendor detections and blocklist listings provides a reliable indicator for network‑level blocking.

Defensive recommendations are to add the domain and its resolved IP address to outbound and inbound deny lists, enforce DNS‑based filtering that includes the known blocklist entry, and monitor for any traffic to or from 188.114.97.3. Organizations should also consider integrating the VirusTotal detection count into automated threat‑intel feeds to trigger alerts when the domain is observed in logs. Continuous re‑evaluation is advised, as additional intelligence such as SSL certificates, HTTP status, or page content may emerge and refine the risk posture.