coq-ai[.]entry-cryptolist[.]app

Analysis of coq-ai.entry-cryptolist.app indicates an active cryptocurrency-themed phishing domain flagged by security vendors as of July 29, 2026. The domain resolves to the IP address 188.114.96.3, which is associated with Cloudflare infrastructure. At the time of assessment, the domain appears on one security blocklist, specifically PhishDestroy, and is detected by 16 of 91 security vendors on VirusTotal, suggesting elevated risk.

The absence of registered nameservers (NS_NOT_FOUND) may indicate misconfigured or intentionally obscured DNS settings, a common tactic in phishing campaigns to evade detection or takedown efforts. The domain's structure, incorporating terms like 'cryptolist' and 'ai,' aligns with tactics observed in cryptocurrency phishing schemes, though the exact content and target brand remain unconfirmed due to limited available data. No registrar details or SSL certificate information were provided, which restricts further infrastructure analysis.

Defenders should treat this domain as malicious and prioritize blocking it at the network level, particularly in environments where cryptocurrency-related activity occurs. Additional monitoring of the IP 188.114.96.3 is recommended, as it may host other phishing domains leveraging the same infrastructure. Given the detection counts and blocklist status, this domain warrants immediate containment measures, including endpoint protection updates and user awareness notifications regarding cryptocurrency phishing risks.