pope-leo-xiv[.]entry-cryptolist[.]app

This domain, pope-leo-xiv.entry-cryptolist.app, is flagged as an active credential phishing site as of July 29, 2026. Analysis indicates elevated risk due to detection by 15 of 91 security vendors on VirusTotal, inclusion on at least one security blocklist, and blocking by PhishDestroy. The domain resolves to IP address 188.114.97.3 but lacks configured nameservers, which may suggest misconfigured or hastily deployed infrastructure.

No registrar or hosting provider details are currently available in the supplied intelligence, limiting attribution. The absence of nameservers could indicate an attempt to evade DNS-based detection or a temporary operational state. Defenders should treat this domain as malicious and prioritize blocking at DNS, IP, and web gateway layers.

The exact phishing target or brand impersonation is not specified in available data; further analysis of the site's content is required to determine the specific lure or credentials being harvested. Given the detection count and blocklist presence, this domain should be considered hostile until proven otherwise. Security teams are advised to monitor for connections to 188.114.97.3 and correlate with any credential theft alerts or anomalous authentication attempts.