sugar-boy[.]entry-cryptolist[.]app

The domain sugar-boy.entry-cryptolist.app is currently active and classified as a generic phishing site with an elevated risk rating as of July 29, 2026. Infrastructure analysis shows that the domain resolves to the IP address 188.114.96.3, which is the sole hosting indicator available. No authoritative nameserver information could be retrieved, as the nameserver query returned NS_NOT_FOUND, suggesting either a recent registration or an attempt to obscure DNS configuration.

VirusTotal has recorded 14 detections out of 91 security vendors, indicating that a subset of scanners have identified malicious characteristics associated with the domain. The domain is listed on a single external blocklist and is specifically blocked by the PhishDestroy service, providing additional confirmation of its abusive nature. The combination of multi‑vendor detections, blocklist presence, and active blocking by PhishDestroy demonstrates a consistent threat profile despite limited public intelligence on the underlying payload or impersonated brand.

Defenders should add the domain and its resolved IP address to network deny lists, enforce DNS filtering policies, and monitor for any outbound connections to the host. Continuous observation of any changes in detection counts or additional blocklist listings is recommended, as further evidence may emerge that clarifies the phishing campaign’s target and methodology.