vmsclassic[.]entry-cryptolist[.]app

vmsclassic.entry-cryptolist.app is currently flagged as a phishing‑related site. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which is associated with a shared hosting provider frequently used by malicious actors. The domain’s authoritative nameserver information could not be retrieved (NS_NOT_FOUND), indicating possible recent registration or misconfiguration. VirusTotal reports that 13 out of 91 scanned security vendors have identified the domain as malicious, providing modest but corroborated detection across multiple engines.

The domain is listed on a single external security blocklist and is actively blocked by the PhishDestroy filtering service, confirming that at least one reputable anti‑phishing platform has taken mitigation action. Publicly available intelligence does not include a page title, SSL certificate details, HTTP response codes, or any observed brand targeting, so the exact phishing vector and lure remain undefined. The absence of these artefacts limits the ability to describe the content or the specific credential‑stealing technique employed. Nevertheless, the convergence of multiple vendor detections, blocklist inclusion, and active blocking by PhishDestroy elevates the risk profile to elevated.

Defenders should block or sinkhole the domain at the network perimeter and ensure that endpoint protection solutions incorporate the latest threat‑intel feeds that contain this indicator. Monitoring for DNS queries to the domain and for outbound connections to 188.114.97.3 can help detect attempted communications. Organizations should also advise users to remain cautious of unsolicited messages that reference “entry‑cryptolist” or similar terminology, as the domain appears to be part of a broader phishing campaign targeting cryptocurrency‑related services. Ongoing observation is recommended to capture any future changes in hosting, SSL deployment, or additional blocklist listings.