syntor-ai[.]entry-cryptolist[.]app

Analysis conducted on July 29, 2026 identifies syntor-ai.entry-cryptolist.app as an active phishing domain targeting cryptocurrency users. Infrastructure analysis reveals the domain resolves to IP address 188.114.97.3, which has been associated with previous phishing campaigns. Security vendor detections are present, with 15 of 91 engines on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy, indicating confirmed phishing activity.

Nameserver records return NS_NOT_FOUND, suggesting either misconfiguration or deliberate evasion of standard DNS practices. No registrar or hosting provider details are currently available, limiting attribution. The domain's structure, incorporating 'crypto' and 'entry' in its subdomains, aligns with common phishing patterns targeting cryptocurrency wallets or exchanges, though the exact content and targeted brand remain unconfirmed.

Defenders should treat this domain as elevated risk and implement blocking at the DNS or network level. Organizations are advised to monitor for connections to 188.114.97.3 and review logs for any interactions with syntor-ai.entry-cryptolist.app. Given the active status and detection by multiple security vendors, this domain should not be considered safe for any user interaction.