nfinity-ai[.]entry-cryptolist[.]app

Analysis of the domain nfinity-ai.entry-cryptolist.app indicates an active phishing campaign targeting cryptocurrency users, as of July 29, 2026. The domain is flagged by 14 of 91 security vendors on VirusTotal, a detection rate that suggests elevated risk despite limited blocklist coverage. Currently, only PhishDestroy has explicitly blocked this domain, while other major threat intelligence platforms have not yet published alerts. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, though no autonomous system or hosting provider details are available in the current dataset. The absence of configured nameservers (NS_NOT_FOUND) further suggests recent or incomplete domain setup, a common tactic in phishing operations to evade early detection.

No registrar or registration date information is provided, limiting assessment of the domain's age or ownership patterns. The lack of nameserver records may also indicate an attempt to obscure hosting relationships or delay takedown efforts. Defenders should note that while the domain exhibits characteristics typical of phishing infrastructure—such as a newly observed resolution and partial vendor detections—its exact content and targeted brands remain unconfirmed. The domain name includes 'cryptolist,' which may imply an attempt to deceive users into interacting with fraudulent cryptocurrency services, though no specific brand impersonation has been verified.

Organizations are advised to treat this domain as high-risk pending further analysis. Network-level blocking of 188.114.96.3 and monitoring for related subdomains under entry-cryptolist.app are recommended. Security teams should correlate this domain with other indicators of compromise, particularly those involving cryptocurrency-themed phishing, and submit samples for deeper inspection if encountered in logs or user reports.