nkn[.]entry-cryptolist[.]app

Analysis of nkn.entry-cryptolist.app shows that the domain is currently active and has been classified as a generic phishing infrastructure with an elevated risk rating. DNS resolution points to the single IPv4 address 188.114.96.3; the authoritative nameserver records could not be retrieved, which is reflected in the “NS_NOT_FOUND” indicator. The domain is listed on one public security blocklist and has been explicitly blocked by the PhishDestroy mitigation service.

VirusTotal has recorded 14 positive detections out of 91 scanned scanners, confirming that multiple anti‑malware engines consider the host malicious. No additional metadata such as SSL certificate details, HTTP response codes, page title, or content signatures are available in the supplied intelligence, leaving the exact payload and target brand undefined. The limited visibility suggests that the operators rely on a minimal footprint, possibly to evade broader detection.

Defenders should immediately block DNS resolution to 188.114.96.3 and add nkn.entry-cryptolist.app to network‑level deny lists. Continuous monitoring of the IP address for new hostnames, as well as periodic re‑scans on VirusTotal, are advised to capture any evolution of the campaign. Given the active status and elevated risk, inclusion of the domain in email‑gateway and web‑proxy filtering policies is recommended.