santa-pepe[.]entry-cryptolist[.]app

Analysis indicates that the domain santa-pepe.entry-cryptolist.app resolves to the IPv4 address 188.114.97.3. The hosting IP is currently listed on a single public security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal scans show that 14 out of 91 antivirus and URL‑reputation engines have flagged the domain as malicious, reinforcing the suspicion of phishing activity. No nameserver records are returned; the query for NS records yields NS_NOT_FOUND, suggesting either a misconfiguration or intentional concealment of DNS infrastructure.

The lack of publicly available WHOIS data, SSL/TLS certificate details, and HTTP response codes prevents a deeper assessment of the site’s operational characteristics. Page‑title and content metadata have not been captured, so the exact branding or lure employed by the site remains unknown. Despite these gaps, the convergence of multiple independent detections, blocklist inclusion, and the existence of a dedicated takedown entry in PhishDestroy constitute sufficient evidence for classifying the domain as a confirmed phishing resource.

Defenders should immediately deny outbound connections to 188.114.97.3, add santa-pepe.entry-cryptolist.app to DNS‑based and proxy blocklists, and monitor the associated IP for any changes in hosting or additional malicious payloads. Continuous re‑scanning with VirusTotal and similar services is recommended to capture any evolution of the threat profile. Organizations that rely on email or web filtering should ensure that their policies reference this indicator to prevent credential harvesting attempts targeting their users.