remus[.]entry-cryptolist[.]app

The domain remus.entry-cryptolist.app is actively serving as a phishing vector as of the report date 29 July 2026. Infrastructure analysis shows that the domain resolves to the IPv4 address 188.114.96.3, a publicly routable host that appears on a single security blocklist. Reputation services have flagged the domain, with fifteen of ninety-one VirusTotal scanners marking it as malicious.

Additionally, the anti‑phishing platform PhishDestroy has listed the domain as blocked, confirming operational detection by at least one dedicated phishing mitigation service. Nameserver queries return no authoritative records (NS_NOT_FOUND), suggesting either a misconfigured delegation or an attempt to obscure DNS ownership details. The domain is classified under the generic phishing threat type and carries an elevated risk rating, indicating a higher likelihood of successful credential harvesting or malicious redirects if accessed.

While the specific content of the hosted pages has not been examined, the observable indicators—multiple vendor detections, blocklist presence, active block status, and the unresolved nameserver state—provide sufficient evidence for security teams to treat the domain as hostile. Defenders should immediately block traffic to 188.114.96.3 and to the fully qualified domain name, incorporate the domain into internal deny‑list feeds, and monitor DNS logs for any resolution attempts. Ongoing observation of related IP ranges and periodic re‑scanning are recommended to capture potential infrastructure changes or additional malicious payloads associated with this campaign.