harold-sol[.]entry-cryptolist[.]app

Analysis of the domain harold-sol.entry-cryptolist.app, observed on 2026-07-29, classifies it as a generic phishing infrastructure with an elevated risk rating. VirusTotal reports that 12 out of 91 scanned security engines have flagged the domain, indicating a moderate consensus of malicious behavior across multiple AV products. The domain resolves to the IPv4 address 188.114.96.3; no additional A records or CNAME aliases were observed in public DNS queries. Nameserver lookup returned NS_NOT_FOUND, suggesting that the authoritative name servers are either hidden, misconfigured, or deliberately omitted from public resolvers.

The IP 188.114.96.3 is associated with a hosting provider that frequently appears in abuse reports, but no ASN, country, or organization details are present in the supplied data. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that at least one defensive feed has recognized it as malicious. No Safe Browsing, Open Threat Exchange (OTX), or registrar registration details are available, so the registration age, registrar name, and contact information remain unknown.

SSL/TLS handshake data, HTTP response codes, page title, and any observed content hashes were not supplied, leaving the surface‑web characteristics of the site unverified. Given the partial evidence—multiple vendor detections, blocklist inclusion, and active sinkhole blocking—security teams should treat any traffic to the domain as hostile, enforce DNS filtering, and consider adding the address 188.114.96.3 to network‑level deny lists. Continuous monitoring for changes in the DNS resolution, additional blocklist appearances, or new vendor detections is recommended to adjust defensive posture as the threat evolves.