ben-the-dog[.]entry-cryptolist[.]app

Analysis of ben-the-dog.entry-cryptolist.app as of July 29, 2026, indicates elevated risk due to confirmed phishing infrastructure targeting cryptocurrency users. The domain is flagged by 16 of 91 security vendors on VirusTotal, a detection rate that exceeds typical false-positive thresholds for newly registered domains. It currently resolves to IP address 188.114.96.3, which has been associated with other high-risk domains in recent threat intelligence feeds. The domain appears on at least one security blocklist, specifically PhishDestroy, which specializes in cryptocurrency-related fraud detection.

Infrastructure review reveals the domain lacks configured nameservers (NS_NOT_FOUND), a common indicator of hastily deployed or disposable phishing sites. The absence of nameservers may also explain intermittent resolution failures observed in passive DNS records. No registrar details or registration date were provided in available intelligence, limiting temporal analysis of the domain's lifecycle. The subdomain structure ('entry-cryptolist') and second-level domain ('app') suggest an attempt to mimic legitimate cryptocurrency tracking or wallet services, though the exact content and targeted brand remain unconfirmed due to lack of page title or kit identification in current data.

Defenders should treat this domain as active and malicious. Recommended actions include blocking resolution to 188.114.96.3 at the network perimeter, adding the domain to endpoint protection and email filtering rules, and monitoring for connections from internal assets. Security teams may cross-reference the IP address with other known phishing campaigns targeting cryptocurrency users. Given the domain's presence on PhishDestroy and detection by multiple vendors, further investigation into associated wallet addresses or transaction patterns is advised if cryptocurrency-related fraud is a priority for the organization.