xrp2-0[.]entry-cryptolist[.]app

The domain xrp2-0.entry-cryptolist.app is currently active and classified as a generic phishing threat with an elevated risk rating. Infrastructure analysis shows that the domain resolves to the IPv4 address 188.114.96.3. No authoritative nameserver records were returned, indicating that the NS lookup failed or the nameservers are deliberately hidden. The domain appears on a single security blocklist, and PhishDestroy has already added it to its block list, confirming that at least one reputable anti‑phishing service has taken protective action.

VirusTotal scans report that 13 of 91 security vendors flagged the domain as malicious, providing independent corroboration of its malicious intent. The detection count suggests that a minority of scanners have identified the site as harmful, but the consensus among the majority is that it poses a phishing risk. No additional intelligence such as registrar details, SSL certificate attributes, HTTP status codes, or page title information is available at this time, leaving those aspects of the campaign unverified.

Defenders should prioritize blocking traffic to the domain at the network perimeter and updating endpoint security policies to include the observed detection signatures. Continuous monitoring of the IP address 188.114.96.3 is advised, as it may host additional malicious payloads or serve as a pivot for related campaigns. Organizations should also consider sharing any future observations with threat‑intel platforms to enrich collective defenses, given the limited visibility currently surrounding this infrastructure.