crt-ai-network[.]entry-cryptolist[.]app

Analysis on crt-ai-network.entry-cryptolist.app as of July 29, 2026 indicates that the domain is actively being used for phishing. The domain resolves to the IPv4 address 188.114.97.3, which is the only host observed in the current dataset. A DNS query for authoritative nameservers returned NS_NOT_FOUND, implying either a misconfiguration or an intentional attempt to hide the domain’s name‑server infrastructure. VirusTotal has processed the domain and twelve of ninety‑one security vendors have raised detections, providing independent corroboration of malicious intent.

The domain is listed on a single external security blocklist and is explicitly blocked by the PhishDestroy service, demonstrating that at least one reputable anti‑phishing organization has taken mitigation action. No additional intelligence such as SSL certificate details, HTTP status codes, page title, brand targeting, or content hashes is present in the supplied feed, leaving the exact phishing payload, victim lure, and operational timeline undefined. The absence of publicly visible nameserver records and the modest detection count suggest a low‑profile operation that may rely on short‑lived hosting or rapid redeployment of infrastructure.

Defenders should add both the FQDN and its resolving IP address to network‑level deny lists, enforce DNS sink‑holing for queries to this name, and monitor outbound traffic for any attempts to contact the host. Organizations that detect credential submissions or login attempts to this domain should treat them as compromised and initiate incident response procedures, including credential resets and forensic analysis. Ongoing surveillance is recommended, as future crawls may reveal additional artifacts such as URL paths, TLS fingerprints, or page content that can refine detection rules.