barry-the-badger[.]entry-cryptolist[.]app

On July 29, 2026 analysts observed that the domain barry-the-badger.entry-cryptolist.app is actively being used in a generic phishing campaign and has been assigned an elevated risk rating. The domain resolves to the IP address 188.114.97.3, which is the sole hosting indicator available. Infrastructure analysis shows that the domain’s authoritative name servers could not be retrieved (NS_NOT_FOUND), limiting further DNS‑based attribution. The domain has been listed on one security blocklist and is currently blocked by the PhishDestroy service, indicating that at least one operational defense has taken mitigation action.

VirusTotal scans report that 15 of 91 security vendors flag the domain as malicious, providing independent corroboration of its suspicious nature. No additional contextual data such as page title, SSL certificate details, or HTTP response codes were supplied, leaving the surface‑web characteristics of the site unverified. The lack of visible page metadata means that defenders cannot confirm the exact content or lure technique employed beyond the generic phishing classification.

Given the confirmed resolution to a public IP, the presence on a blocklist, and multiple vendor detections, security teams should continue to block the domain at network perimeter devices, update DNS filtering policies, and monitor for any related indicators of compromise that reference the same IP address. Analysts should also consider querying additional passive DNS and certificate transparency sources to enrich the attribution profile, as the current evidence set is limited to basic DNS resolution and vendor flags. Continuous observation is advised to detect any evolution of the campaign or emergence of new hosting infrastructure.