mock-capital[.]entry-cryptolist[.]app

Analysis of the domain mock-capital.entry-cryptolist.app indicates elevated risk of cryptocurrency-related phishing activity as of July 29, 2026. The domain is flagged by 13 of 91 security vendors on VirusTotal, a detection rate consistent with known phishing infrastructure. It resolves to the IP address 188.114.97.3, which has been associated with other malicious domains but currently lacks additional context regarding hosting provider or autonomous system details. The domain appears on one security blocklist, specifically PhishDestroy, which categorizes it as active and malicious.

Infrastructure review reveals the domain lacks configured nameservers (NS_NOT_FOUND), a technical anomaly that may indicate incomplete setup, rapid takedown attempts, or evasion tactics. No registrar or registration date details are available in the provided intelligence, limiting assessment of domain age or ownership patterns. The absence of nameservers does not prevent resolution but may affect long-term stability or detection by automated systems. No Safe Browsing, Open Threat Exchange (OTX), or SSL certificate details are present in the available data, and the exact content or targeted brand remains unconfirmed.

The domain name structure, including terms 'mock-capital' and 'crypto-list,' suggests a focus on financial or cryptocurrency deception, though no specific brand impersonation (e.g., Coinbase, Binance) is verified. Defenders should treat this domain as actively malicious, block resolution at the network level, and monitor for connections from internal assets. Further analysis of the resolved IP and any associated domains is recommended to identify related threats.