sirius[.]entry-cryptolist[.]app

The domain sirius.entry-cryptolist.app is currently classified as an active generic phishing infrastructure with an elevated risk rating. Technical analysis shows that the domain resolves to the IPv4 address 188.114.97.3. No authoritative name server information is available, as the nameserver query returned NS_NOT_FOUND, which may indicate deliberate obfuscation of DNS infrastructure. The domain has been added to at least one public security blocklist and is explicitly blocked by the PhishDestroy service, demonstrating that external defenses have already taken mitigation steps.

On VirusTotal, 12 of 91 independent security scanners flagged the domain as malicious, providing a detection ratio that suggests a non‑trivial level of confidence among automated tools. The specific detections were not enumerated, but the aggregate result reinforces the suspicion raised by other sources. No additional intelligence such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts were supplied, leaving those vectors unverified at this time.

Given the limited but consistent evidence—DNS resolution to a single IP, presence on a blocklist, active blocking by PhishDestroy, and multiple vendor detections—defenders should treat the domain as hostile. Recommended actions include adding the domain and its resolved IP address to perimeter firewalls and DNS filtering policies, monitoring for any outbound connections to the IP, and alerting end‑user devices to block credential submission attempts targeting the domain. Continuous re‑evaluation is advised, as further investigative data such as page content, SSL fingerprints, or additional blocklist entries could clarify the scope of the campaign.