nodelight[.]entry-cryptolist[.]app

Analysis as of July 29 2026 indicates that the domain nodelight.entry-cryptolist.app is currently active and has been classified with an elevated risk rating. The domain resolves to the IPv4 address 188.114.97.3; no nameserver records were returned, which may hinder DNS‑based mitigation. It has been listed on one external security blocklist and was specifically blocked by the PhishDestroy service, demonstrating that at least one industry‑focused sinkhole has taken action against it.

VirusTotal reports that 13 of 91 scanned security vendors flagged the domain as malicious, providing modest but notable consensus among scanners. No additional context such as a page title, SSL certificate details, HTTP response code, or evidence links has been published, so the exact content served by the site remains unverified. Likewise, Safe Browsing, OTX, registrar information, and trust‑score metrics are not presently available in the shared intelligence.

Given the limited but consistent indicators—blocklist presence, PhishDestroy block, and multi‑vendor detections—defenders should assume the domain is being used for phishing activities. Recommended actions include adding the IP address 188.114.97.3 to network deny lists, configuring DNS filtering to block the domain, and updating endpoint and email security policies to flag any traffic to this host. Continuous monitoring for changes in SSL status, HTTP responses, or new detection counts is advised, as further evidence may emerge that clarifies the specific phishing campaign or target brand.