hermy-the-stallion[.]entry-cryptolist[.]app

The domain hermy-the-stallion.entry-cryptolist.app has been observed in active malicious infrastructure as of July 29, 2026. It appears on a single security blocklist and is explicitly blocked by the PhishDestroy filtering service, indicating that at least one anti‑phishing vendor has taken defensive action against it. DNS resolution returns the IPv4 address 188.114.97.3, confirming that the domain is presently hosted and reachable on the public internet.

VirusTotal scans have produced a consensus of 13 out of 91 security vendors flagging the domain, providing a modest but notable indication of malicious behavior across multiple detection engines. Nameserver queries failed, returning NS_NOT_FOUND, which suggests that the authoritative name servers either do not respond to standard queries or that the domain is using an atypical DNS configuration that hampers resolution of its NS records. No additional intelligence such as registrar details, SSL certificate information, HTTP response codes, page title, or explicit brand targeting is available at this time.

The combination of blocklist inclusion, vendor detections, and active IP resolution points to a credential‑harvesting operation that is currently live. Defenders should consider adding hermy-the-stallion.entry-cryptolist.app to URL filtering rules, monitoring outbound connections to 188.114.97.3, and employing DNS sinkholing where feasible. Continuous re‑evaluation is advised, as further data—particularly HTTP payloads or page content—may emerge to clarify the specific phishing vector and victim profile.