goggles[.]entry-cryptolist[.]app

Analysis of the domain goggles.entry-cryptolist.app as of 2026-07-29 indicates active generic phishing infrastructure. DNS resolution points to the IPv4 address 188.114.97.3; no authoritative nameserver records were returned, suggesting the domain may be using privacy-protected or dynamically configured name servers. The domain is currently listed on a single security blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one reputable anti-phishing service has observed malicious use.

VirusTotal scans show that 13 of 91 scanned security vendors flagged the domain, providing independent confirmation of malicious intent. The relatively low detection count may reflect limited exposure or recent deployment, but the presence of any detections warrants caution. Evidence beyond DNS and reputation feeds is not available; page title, SSL certificate details, HTTP response codes, and content analysis have not been published, leaving the exact phishing lure and targeted brand uncertain.

The absence of publicly disclosed registrar information further limits attribution of the operator. Defenders should treat the domain as hostile: add goggles.entry-cryptolist.app and its resolved IP address 188.114.97.3 to URL filtering and network-level blocklists, monitor DNS queries for similar sub-domains, and enforce outbound traffic controls to prevent credential exfiltration. Continuous re-evaluation is recommended, as additional detections or content snapshots may emerge from threat-intel platforms.