punkvism[.]entry-cryptolist[.]app

Analysis of punkvism.entry-cryptolist.app indicates an active phishing domain targeting cryptocurrency users, flagged by multiple security vendors as of July 29, 2026. The domain resolves to IP address 188.114.96.3, which is associated with hosting infrastructure frequently exploited for phishing campaigns. Infrastructure checks reveal the domain lacks configured nameservers (NS_NOT_FOUND), a common indicator of hastily deployed or ephemeral phishing sites designed to evade detection. It appears on at least one security blocklist and is actively blocked by PhishDestroy, suggesting prior abuse reports or automated detection of malicious behavior.

VirusTotal scans show 16 of 91 security vendors flagging the domain as malicious, though the specific nature of the threat—such as credential harvesting, wallet drainer scripts, or fake token giveaways—remains unconfirmed due to limited public analysis. The domain's structure, including the subdomain 'punkvism' and parent domain 'entry-cryptolist.app,' aligns with patterns observed in cryptocurrency-themed phishing, though no brand impersonation (e.g., MetaMask, Ledger) is explicitly identified in available data. No SSL certificate details, HTTP response codes, or page titles are currently available for further classification.

Defenders should treat this domain as high-risk for cryptocurrency-related fraud. Recommended actions include blocking the domain and IP at network perimeter controls, alerting users to avoid interaction, and monitoring for related subdomains or IPs under the same infrastructure. Further analysis, such as sandbox execution or deeper WHOIS investigation, may clarify the exact phishing mechanism, but current evidence justifies immediate containment measures.