catton-ai[.]entry-cryptolist[.]app

This domain, catton-ai.entry-cryptolist.app, is actively flagged as part of a cryptocurrency-themed phishing infrastructure. Analysis indicates it resolves to the IP address 188.114.97.3, which has been associated with other malicious activities. As of July 29, 2026, the domain is detected by 15 out of 91 security vendors on VirusTotal, signaling elevated risk. It also appears on at least one security blocklist and is currently blocked by PhishDestroy.

Infrastructure review reveals the domain lacks configured nameservers, a common tactic to obscure ownership and evade takedowns. The domain's structure, including the subdomain 'entry-cryptolist,' suggests it is designed to target users involved in cryptocurrency transactions or listings, though the exact content and brand impersonation—if any—remain unconfirmed due to limited page-level analysis. Defenders should treat this domain as high-risk for credential harvesting or fraudulent token distribution.

Immediate action includes blocking resolution at the DNS level and monitoring for connections to the associated IP. Further investigation into the hosting provider and SSL certificate details is recommended to identify additional linked infrastructure. Given the domain's active status and detection by multiple security mechanisms, organizations should prioritize containment and alert affected user groups about potential exposure.