nodelyia[.]entry-cryptolist[.]app

The domain nodelyia.entry-cryptolist.app is currently flagged as an active generic phishing infrastructure with an elevated risk rating. Technical analysis shows that the domain resolves to the IP address 188.114.97.3, a host that appears on at least one public security blocklist. No authoritative nameserver records are available, indicating that the domain’s DNS configuration may be deliberately obscured or that the registrar’s DNS service is not responding to standard queries. VirusTotal data reveals that 15 of 91 security vendors have identified the domain as malicious, providing independent confirmation of its suspicious nature. Additionally, the domain is listed by PhishDestroy, a dedicated anti‑phishing blocklist, reinforcing the consensus that it is being used for credential‑harvesting or related fraudulent activity.

Infrastructure indicators suggest a low‑profile hosting arrangement, possibly leveraging shared services to blend with legitimate traffic. The absence of publicly visible nameserver information limits the ability to trace ownership or assess the stability of the hosting environment. The presence on a blocklist and multiple vendor detections constitute concrete evidence that the domain is actively involved in phishing campaigns, although the exact payload or targeted brand has not been disclosed in the available intelligence.

Defenders should prioritize immediate blocking of the domain at perimeter defenses and DNS filtering layers. Continuous monitoring of the associated IP address (188.114.97.3) is advised, as it may serve additional malicious domains in the future. Organizations employing threat‑intelligence feeds should ensure that their feeds incorporate the blocklist entries from PhishDestroy and the VirusTotal detections to maintain up‑to‑date protection.