frog-king[.]entry-cryptolist[.]app

Analysis of frog-king.entry-cryptolist.app, observed on July 29, 2026, indicates an active generic phishing infrastructure. The domain resolves to IP address 188.114.97.3, which is the sole hosting endpoint identified. No authoritative name server information could be retrieved (NS_NOT_FOUND), suggesting possible use of transient or obscured DNS configuration. VirusTotal records show that 14 of 91 security vendors have flagged the domain as malicious, providing corroborating evidence of its abusive nature.

The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy mitigation service, confirming that at least one reputable anti‑phishing provider has taken protective action. At present, no WHOIS data is publicly available, and the registrar cannot be identified, which hinders attribution of ownership. SSL/TLS details have not been disclosed, and HTTP status codes have not been observed, leaving the surface‑web behavior unverified. The lack of additional public intelligence such as registrar details, SSL certificate information, HTTP response codes, or page title limits the depth of attribution, but the existing indicators are sufficient to classify the site as a confirmed phishing threat.

Defenders should block DNS resolution to 188.114.97.3, incorporate the domain into web‑filtering and email‑gateway deny lists, and monitor related traffic for potential exploitation attempts. Ongoing observation is recommended to detect any changes in hosting, additional blocklist listings, or emergence of new detection signatures. Security teams are encouraged to share the observed indicators with industry‑wide threat‑sharing platforms to improve collective detection and response.