griffin-ai[.]entry-cryptolist[.]app

The domain griffin-ai.entry-cryptolist.app was observed on July 29, 2026 and is currently classified as a generic phishing site. Early detection by the PhishDestroy sinkhole indicates that the domain has been actively used in credential‑harvesting campaigns. VirusTotal scans returned 12 positive detections out of 91 submitted security engines, confirming that multiple anti‑malware products consider the host malicious. The domain appears on a single public blocklist, reinforcing its reputation as a threat vector.

DNS resolution points to the IPv4 address 188.114.96.3; no authoritative name servers were returned, which may reflect intentional DNS hiding or a misconfigured hosting environment. The hosting IP belongs to a range commonly associated with fast‑flux and disposable hosting services, increasing the likelihood of rapid infrastructure turnover. No additional metadata such as SSL certificate details, HTTP status codes, page titles, or content hashes were available at the time of analysis, leaving the exact landing page content undocumented. Defenders should treat any traffic to this domain as hostile.

Recommendations include adding the domain and its resolved IP address to outbound deny lists, monitoring DNS queries for similar sub‑domains under entry‑cryptolist.app, and enabling real‑time blocklist updates from PhishDestroy and other threat‑intel feeds. Continuous re‑scanning of the host on VirusTotal or similar sandboxes is advised to capture any evolving payloads or new detection signatures. Organizations employing email filtering should flag messages containing links to this domain, and incident response teams should collect any payloads associated with it for deeper forensic examination.