tajir-media[.]entry-cryptolist[.]app

On July 29, 2026 the domain tajir-media.entry-cryptolist.app was observed actively hosting a generic phishing campaign. DNS resolution returns the IPv4 address 188.114.96.3; the authoritative nameserver records could not be retrieved (NS_NOT_FOUND). The domain has been flagged by 14 of 91 security engines on VirusTotal, indicating a moderate consensus of malicious classification. Independent blocklist providers have already taken action: PhishDestroy lists the domain as blocked, and it appears on one additional security blocklist. The risk rating assigned to the infrastructure is elevated, reflecting the combination of active hosting, multiple vendor detections, and existing blocklist entries.

No public information about the web server’s SSL certificate, HTTP response codes, or page title is currently available, and the page content has not been captured in the intelligence feed. Consequently, the specific brand or service that the site attempts to impersonate cannot be confirmed at this time. The lack of visible page metadata limits attribution, but the presence of multiple vendor detections and blocklist listings strongly suggests the site is being used to harvest credentials or other sensitive information. Defenders should immediately add tajir-media.entry-cryptolist.app to URL filtering and DNS sinkhole policies.

Network traffic to the associated IP address 188.114.96.3 should be monitored and, where feasible, blocked. Organizations employing threat‑intelligence feeds are advised to ensure the domain is included in their blocklist subscriptions, and to watch for any future resolution changes that might indicate additional hosting infrastructure. Continuous re‑scanning on VirusTotal or similar platforms is recommended to capture any evolution in vendor detections.