banana-chain[.]entry-cryptolist[.]app

Analysis conducted on July 29, 2026, confirms that the domain banana-chain.entry-cryptolist.app is actively engaged in cryptocurrency-themed phishing operations. The domain resolves to the IP address 188.114.96.3, which is associated with hosting infrastructure frequently exploited for malicious campaigns. At the time of assessment, the domain appears on one security blocklist, specifically PhishDestroy, indicating prior identification as a threat. Additionally, 16 out of 91 security vendors on VirusTotal have flagged the domain as malicious, further corroborating its classification as a phishing site.

Infrastructure analysis reveals anomalous characteristics, including the absence of valid nameservers, which may suggest an attempt to evade detection or disrupt takedown efforts. The domain's registration details remain undisclosed, limiting attribution efforts. The IP address 188.114.96.3 does not provide immediate clarity on the hosting provider or geographic origin, though historical data may link it to bulletproof or compromised hosting environments. The exact nature of the phishing content hosted on banana-chain.entry-cryptolist.app has not been fully analyzed, but the domain name and detection context strongly imply a focus on cryptocurrency fraud, potentially targeting wallet credentials, private keys, or decentralized finance (DeFi) platforms.

Defenders are advised to treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Organizations should monitor for connections to 188.114.96.3 and review logs for any interactions with this domain. Given the elevated detection rate and active status, further investigation into associated infrastructure and potential victim reports is recommended to mitigate ongoing threats.