gainz[.]entry-cryptolist[.]app

This domain, gainz.entry-cryptolist.app, is currently classified as a generic phishing campaign and remains active as of the report date, 29 July 2026. Infrastructure analysis shows that the name resolves to the IPv4 address 188.114.97.3. The host is listed by the blocklist service PhishDestroy, indicating that the domain has been deliberately taken down by that protective platform. VirusTotal records show that 14 of 91 security‑vendor scanners flag the domain as malicious, providing modest but consistent detection across independent tools.

Additionally, the domain appears on one external security blocklist, reinforcing the view that it is considered unsafe by at least one third‑party threat‑intelligence source. Public DNS data for the domain is incomplete; the authoritative nameservers could not be retrieved (NS_NOT_FOUND), which limits the ability to assess registrar details, name‑server hierarchy, or potential use of fast‑flux techniques. No SSL/TLS certificate information is available, and there are no published HTTP response codes, page titles, or Safe Browsing verdicts linked to the domain in the current intelligence set. Consequently, the visual or functional characteristics of the hosted site remain unknown, and any attribution to a specific brand or lure cannot be confirmed.

At present, no evidence of a valid TLS certificate, redirect chain, or content fingerprint has been disclosed, so analysts should obtain a live sample if operationally safe to confirm the phishing vector. Given the observed indicators—resolved IP, multiple vendor detections, blocklist inclusion, and PhishDestroy takedown—defenders should treat the domain as a high‑confidence phishing indicator. Recommended actions include adding the fully qualified domain name and its resolving IP address to outbound and inbound firewall deny lists, updating DNS‑based blocking feeds, and monitoring for any sudden changes in DNS resolution or additional hosting footprints.