soulbucks[.]entry-cryptolist[.]app

Analysis of the domain soulbucks.entry-cryptolist.app indicates that it is actively being used for phishing. The domain resolves to the IP address 188.114.96.3, which is hosted on a shared infrastructure that does not provide publicly visible name‑server records (NS_NOT_FOUND). Reputation checks show that 13 out of 91 security vendors on VirusTotal have flagged the domain, demonstrating a moderate level of consensus regarding its malicious nature.

The site is currently listed on a single security blocklist and has been blocked by the PhishDestroy mitigation service, confirming that at least one external sinkhole has taken action against it. No additional intelligence such as a page title, target brand, or phishing kit identifier is available at this time, so the exact content and the specific brand being spoofed remain unknown. The lack of publicly published name‑server information suggests the registrant may be using privacy protection or a fast‑flux service to obscure ownership.

Defenders should add the domain and its resolved IP address to local deny‑lists, monitor DNS queries for repeated look‑ups, and ensure that email gateways and web filters reference the latest threat intel feeds that include this indicator. Because the domain is already flagged by multiple vendors, continued observation is advised to detect any escalation, such as the appearance of additional blocklist entries or a rise in detection counts. Organizations that employ outbound traffic monitoring should consider blocking HTTP/HTTPS connections to 188.114.96.3 until further investigation confirms the domain is safe.