dolos-the-bully[.]entry-cryptolist[.]app

Analysis of dolos-the-bully.entry-cryptolist.app shows that the domain is currently active and resolves to the IPv4 address 188.114.96.3. VirusTotal reports that 12 of 91 security vendors have flagged the domain, indicating a moderate consensus among commercial scanners that the site is malicious. The domain appears on a single external security blocklist and is explicitly listed in the PhishDestroy blocklist, confirming that at least one dedicated anti‑phishing service has taken protective action against it.

DNS interrogation returned no authoritative nameserver records (NS_NOT_FOUND), which may suggest a deliberately sparse DNS footprint or recent manipulation of the zone. No additional infrastructure details such as ASN, hosting provider, or SSL certificate information are available in the current intelligence set. The lack of publicly visible page title, brand reference, or content snapshot means that the exact phishing lure or credential‑harvesting template cannot be confirmed at this time.

Defenders should prioritize immediate containment by adding dolos-the-bully.entry-cryptolist.app to local URL filtering and DNS block policies, and consider blocking the associated IP address 188.114.96.3 pending further network‑level verification. Continuous monitoring of the domain’s resolution behavior and periodic rescans with VirusTotal or similar aggregators are recommended to detect any changes in vendor detection scores or additional blocklist listings. Organizations employing email or web gateway security should ensure that phishing‑specific signatures, especially those related to credential‑harvesting campaigns, are up‑to‑date, as the current evidence points to an active threat vector targeting user credentials.