mcp-ai[.]entry-cryptolist[.]app

On July 29, 2026 the domain mcp-ai.entry-cryptolist.app was observed actively hosting a generic phishing campaign. DNS resolution returns the IPv4 address 188.114.96.3; no authoritative name-server records could be retrieved, as the nameserver query returned NS_NOT_FOUND. VirusTotal has recorded 13 detections out of 91 scanned security vendors, indicating that multiple anti-malware engines flag the domain as malicious. The domain is currently listed on a single security blocklist and is explicitly blocked by the PhishDestroy filtering service, reinforcing the assessment of elevated risk.

No additional telemetry such as SSL certificate details, HTTP response codes, page title, or brand targeting has been published, so the exact content of the landing page remains unknown. The absence of further infrastructure data limits attribution, but the presence of a dedicated IP address and the detection history suggest a purpose-built operation rather than an incidental misconfiguration. Defenders should add 188.114.96.3 to network-level deny lists, enforce DNS sinkholing for the domain, and monitor outbound traffic for attempts to resolve or contact the host.

Email security gateways should treat any message containing the domain as malicious and quarantine or reject it. Continuous re-scanning on VirusTotal and inclusion in threat-intel feeds are recommended to capture any evolution of the payload or additional detections. Organizations that have observed credential-capture attempts should compare payload hashes against known samples associated with the 13 vendor detections to determine overlap.