shillguy[.]entry-cryptolist[.]app

Analysis of the domain shillguy.entry-cryptolist.app indicates an active cryptocurrency-themed phishing endpoint as of July 29, 2026. The domain resolves to the IP address 188.114.96.3, which has been associated with prior phishing infrastructure. Infrastructure review reveals the domain lacks configured nameservers, a common tactic to evade automated detection or hinder WHOIS-based investigations. Detection data shows the domain is flagged by 13 of 91 security vendors on VirusTotal, a detection rate consistent with confirmed malicious activity.

Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy, further corroborating its classification as a phishing threat. The domain's structure, including the subdomain 'entry-cryptolist,' suggests an intent to target users seeking cryptocurrency-related services, though the exact content and mechanics of the phishing scheme remain unconfirmed due to the absence of detailed page analysis. Defenders should treat this domain as high-risk and prioritize blocking it at the network and endpoint levels.

Given the lack of nameserver configuration, monitoring for changes in DNS resolution or registrar updates may provide additional indicators of compromise. Organizations are advised to correlate this domain with internal logs for potential exposure and review related IP traffic to 188.114.96.3 for signs of compromise. No brand-specific attributes or phishing kit identifiers are currently available in the provided intelligence.