gofundmeme[.]entry-cryptolist[.]app

This domain, gofundmeme.entry-cryptolist.app, was observed on July 29, 2026 as an active generic phishing infrastructure. DNS resolution points to the IPv4 address 188.114.96.3. The domain is listed on a single security blocklist and is currently blocked by the PhishDestroy service, indicating that at least one anti‑phishing feed has identified it as malicious. VirusTotal analysis shows that 13 of 91 scanning engines have flagged the domain, providing additional corroboration of its malicious nature.

The authoritative name‑server information could not be retrieved (NS_NOT_FOUND), which may be an intentional tactic to hinder attribution or a misconfiguration. No further details such as SSL certificate data, HTTP response codes, or page title are available in the supplied intelligence, leaving the exact content and lure technique undocumented. The limited visibility into the hosting environment and the absence of additional blocklist entries suggest that the campaign may be in an early or low‑profile stage, but the elevated risk rating reflects the potential impact of credential‑stealing or financial fraud. Defenders should add 188.114.96.3 to network‑level deny lists, enforce DNS filtering for the full domain, and monitor outbound traffic for connections to this address.

Email gateways should block messages that reference the domain or contain URLs matching the pattern *.entry-cryptolist.app. Continuous re‑inspection of the domain on VirusTotal and other sandbox services is advised, as further detections may emerge. Organizations should also consider reviewing authentication logs for signs of credential reuse that could be linked to this phishing operation.