harry-bolz[.]entry-cryptolist[.]app

Analysis as of July 29, 2026 indicates that harry-bolz.entry-cryptolist.app is currently active and classified as a generic phishing infrastructure. The domain resolves to the IPv4 address 188.114.96.3; no authoritative name server information could be retrieved, as the nameserver query returned NS_NOT_FOUND. The host is listed on a single security blocklist and is actively blocked by the PhishDestroy sink‑hole service. VirusTotal scans show that 13 out of 91 antivirus and URL‑reputation engines have flagged the domain, confirming a consensus of malicious intent among a subset of vendors.

The detection count suggests that the domain is recognized by a modest proportion of the security community, but the absence of broader coverage implies limited visibility. No additional metadata such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts are available in the current intelligence set, leaving the exact content and delivery mechanisms of the phishing campaign unverified. The lack of registrar or creation‑date information further restricts attribution efforts. Defenders should prioritize network‑level blocking of the resolved IP address and add the fully qualified domain name to DNS‑based deny lists.

Continuous monitoring of the IP reputation and periodic re‑scanning on VirusTotal or similar platforms are recommended to capture any changes in vendor detections. Where feasible, redirecting traffic to a sink‑hole such as PhishDestroy can provide additional telemetry on the campaign’s scope. Given the elevated risk rating, inclusion of the domain in endpoint URL filtering policies is advised.