kommunitas[.]entry-cryptolist[.]app

Analysis of the domain kommunitas.entry-cryptolist.app indicates it is an active phishing infrastructure targeting cryptocurrency users. As of July 29, 2026, the domain resolves to the IP address 188.114.97.3, which is associated with hosting providers commonly used for malicious campaigns. Infrastructure checks reveal the domain lacks configured nameservers (NS_NOT_FOUND), a technical anomaly that often accompanies hastily deployed phishing sites or domains intended for short-term use. The domain appears on at least one security blocklist, and 15 of 91 security vendors on VirusTotal have flagged it as malicious, though the absence of additional context from these detections limits attribution to a specific threat actor or phishing kit.

No registrar or hosting provider details are currently available, and the domain's SSL certificate and HTTP response status have not been publicly documented. The name 'entry-cryptolist' in the subdomain suggests an attempt to deceive users into believing the site is related to a cryptocurrency listing or entry service, potentially targeting users of the 'Kommunitas' platform or similar projects. However, without direct analysis of the page content, the exact nature of the phishing lure—such as fake token sales, airdrop scams, or credential harvesting—remains unconfirmed. Defenders should treat this domain as high-risk infrastructure.

Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or managing user wallets. Security teams should monitor for connections to 188.114.97.3 and investigate any user reports of interaction with the domain. Given the domain's presence on blocklists and detection by multiple security vendors, further analysis—including sandbox execution or web crawler inspection—is warranted to determine the full scope of the threat and identify any associated campaigns.