nativ[.]entry-cryptolist[.]app

Analysis of the domain nativ.entry-cryptolist.app, observed on 29 July 2026, indicates active generic‑phishing infrastructure. DNS resolution points exclusively to the IPv4 address 188.114.96.3; no alternative A or AAAA records were identified, and the authoritative nameservers could not be retrieved (NS_NOT_FOUND). The hosting IP belongs to a provider that is frequently leveraged for short‑lived malicious sites, but further attribution is limited by the absence of ASN or WHOIS details in the supplied data. Reputation services have flagged the domain.

The PhishDestroy sinkhole lists the domain as blocked, and it appears on a single external security blocklist. VirusTotal scans show that 13 of 91 antivirus and URL‑reputation engines returned a malicious verdict, reinforcing the classification as a phishing host. No additional evidence such as SSL certificate details, HTTP response codes, page title, or Safe Browsing identifiers were supplied, leaving the content of the landing page unverified. Given the confirmed resolution to a known malicious IP, the presence on PhishDestroy, and the multi‑vendor detection, defenders should treat nativ.entry-cryptolist.app as hostile.

Network perimeter devices, DNS filtering solutions, and endpoint security suites should block connections to the domain and to its resolved IP address. Continuous monitoring of threat‑intel feeds for any emergence of new blocklist entries or additional vendor detections is recommended. Because the domain’s registrar and registration timestamps are not disclosed, further investigation into ownership may be required to support takedown efforts.