bitcoin-2-0-2[.]entry-cryptolist[.]app

Analysis dated July 29 2026 classifies bitcoin-2-0-2.entry-cryptolist.app as an active generic phishing infrastructure with an elevated risk rating. The domain resolves to the IPv4 address 188.114.96.3, providing a concrete network indicator that can be correlated with traffic logs. VirusTotal reports that 15 of 91 security vendors have flagged the domain, confirming that a measurable subset of commercial scanners recognize malicious behavior. Nameserver queries return no result, indicating that the authoritative NS records are either hidden or deliberately omitted, which complicates domain‑ownership verification and may be used to evade passive DNS monitoring.

The domain appears on a single public blocklist and is specifically blocked by the PhishDestroy service, demonstrating that at least one dedicated anti‑phishing platform has taken mitigation action. Defenders should prioritize blocking the domain at DNS resolvers and adding the IP address 188.114.96.3 to network‑level deny lists to stop outbound connections. Correlating internal logs for any DNS queries or HTTP requests to this host will help identify compromised hosts or ongoing credential‑harvesting attempts.

Because the threat surface lacks publicly available page titles, SSL certificate details, or other host metadata, further investigative steps such as sandboxed page retrieval or passive TLS collection are recommended to enrich the indicator set. Continuous monitoring of the IP reputation and inclusion of the domain in security‑information‑and‑event‑management (SIEM) correlation rules will improve detection of repeat attempts. Until additional contextual data is obtained, the current evidence—multiple vendor detections, blocklist presence, and active status—justifies maintaining the elevated risk posture and enforcing strict outbound controls for this domain.