floos[.]entry-cryptolist[.]app

Analysis of the domain floos.entry-cryptolist.app indicates active malicious infrastructure targeting credential theft. The domain resolves to the IPv4 address 188.114.97.3, a host that appears on a single public security blocklist and is currently blocked by the PhishDestroy service. VirusTotal has recorded detections from 13 of 91 scanning engines, confirming that a notable portion of the security community classifies the site as hostile.

No authoritative name server information is available; the domain’s DNS records return NS_NOT_FOUND, suggesting either a misconfiguration or intentional obfuscation of the hosting environment. The lack of publicly disclosed registrar, registration dates, SSL certificate details, HTTP response codes, or page title prevents a deeper content‑level assessment at this time. Nonetheless, the convergence of multiple independent detections, blocklist inclusion, and the presence of a dedicated takedown feed (PhishDestroy) provide sufficient evidence to deem the domain a credential‑harvesting phishing site.

Defenders should add the IP address 188.114.97.3 to network‑level deny lists, enforce URL filtering for the full domain, and monitor outbound traffic for attempted connections to the host. Endpoint protection solutions that reference VirusTotal detection counts should be configured to flag any process that attempts to retrieve resources from this domain. Continuous re‑evaluation is advised, as future changes to DNS, hosting, or page content could alter the threat profile.