juju[.]entry-cryptolist[.]app

On July 29, 2026, the domain juju.entry-cryptolist.app was classified as a generic phishing infrastructure with an elevated risk rating. The domain resolves to the IPv4 address 188.114.97.3, which is currently the sole hosting endpoint observed. DNS queries return no authoritative nameserver records (NS_NOT_FOUND), indicating that the domain is likely using a private or dynamically managed DNS configuration. VirusTotal analysis shows that 15 out of 91 scanned security vendors have generated a detection for the domain, confirming that multiple independent products consider the host malicious.

The domain is listed on a single external security blocklist and is actively blocked by the PhishDestroy service, demonstrating that at least one community‑maintained blacklist has incorporated the indicator into its defenses. The available intelligence does not provide registrar information, SSL certificate details, or HTTP response codes, leaving the broader infrastructure characteristics uncertain. The lack of publicly visible nameserver entries hampers rapid attribution of the hosting provider, and the single blocklist appearance suggests limited propagation in broader threat‑sharing feeds. Nonetheless, the convergence of vendor detections and the presence on a phishing‑specific blocklist indicate that the domain is being used to lure victims, likely to collect credentials or other sensitive data.

Defenders should add 188.114.97.3 and juju.entry-cryptolist.app to existing URL filtering, DNS sinkhole, and endpoint blocklists. Monitoring for DNS queries to the domain, as well as outbound connections to the associated IP, can help identify compromised clients. Where possible, security teams should update intrusion‑prevention signatures to include the observed detection patterns from the 15 reporting vendors.