brandy[.]entry-cryptolist[.]app

Analysis of the domain brandy.entry-cryptolist.app indicates active phishing infrastructure targeting cryptocurrency users. As of July 29, 2026, the domain resolves to the IP address 188.114.96.3, which lacks associated nameserver records (NS_NOT_FOUND), a common characteristic of ephemeral phishing sites. The domain is flagged by 16 of 91 security vendors on VirusTotal, with PhishDestroy explicitly blocking it, suggesting detection of malicious intent. The presence on a single security blocklist, while limited, aligns with early-stage phishing campaigns where broader detection may still be developing.

Infrastructure analysis reveals no identifiable registrar or hosting provider details, which may indicate the use of privacy services or bulletproof hosting to obscure ownership. The IP address 188.114.96.3 does not currently resolve to known benign services, further supporting the likelihood of malicious use. The domain's structure, incorporating terms like 'crypto' and 'list,' implies a focus on cryptocurrency-related lures, though the exact content or targeted brand remains unconfirmed due to the absence of page title or kit analysis in available intelligence. Defenders should treat this domain as elevated risk, particularly for users engaging with cryptocurrency platforms.

Immediate blocking at the network and endpoint levels is recommended, alongside monitoring for related domains using similar naming conventions (e.g., 'entry-cryptolist'). Given the domain's active status and detection by multiple security vendors, further investigation into associated IP ranges and hosting providers may uncover additional linked infrastructure. No evidence currently suggests this campaign is part of a larger, previously documented phishing kit, but the lack of transparency in its registration and hosting warrants heightened scrutiny.