official-simpson[.]entry-cryptolist[.]app

The domain official-simpson.entry-cryptolist.app is currently active and has been observed targeting users with a generic credential‑harvesting campaign. VirusTotal records indicate that 14 of 91 security vendors classify the domain as malicious, demonstrating a moderate consensus of detection across independent scanners. The domain is listed on a single public blocklist and is explicitly blocked by the PhishDestroy filtering service, reinforcing its malicious reputation. DNS resolution returns the IPv4 address 188.114.96.3; no authoritative nameservers were identified, which may indicate a transient or misconfigured hosting setup.

No SSL/TLS certificate details, HTTP response codes, or page title information are publicly available, limiting the ability to confirm the exact content served by the site. Consequently, the precise brand or service being impersonated remains unknown, and the attack vector appears limited to generic phishing pages that solicit login credentials or personal data. Defenders should immediately add official-simpson.entry-cryptolist.app to domain‑based deny lists and, where possible, block outbound connections to 188.114.96.3 at the network perimeter. Continuous monitoring of DNS queries for this domain is advised to detect any internal resolution attempts.

Correlating proxy or web‑gateway logs for requests to the IP address can help identify compromised endpoints. Organizations that employ threat‑intel enrichment should ingest the VirusTotal detection count and the PhishDestroy block status to improve automated detection rules. Because the site lacks visible TLS protection, any attempted HTTPS connections are likely to fail or be intercepted, offering an additional signal for security tooling. Finally, incident response teams should consider the domain as a potential indicator of compromise in recent phishing‑related alerts and include it in broader threat‑hunting queries across email, endpoint, and network telemetry.