io-net[.]entry-cryptolist[.]app

Analysis on 29 July 2026 confirms that io-net.entry-cryptolist.app is actively being used as a phishing platform. The domain resolves to the IPv4 address 188.114.96.3, which is the sole hosting point observed. A VirusTotal scan returned 13 positive detections out of 91 submitted security engines, indicating that multiple commercial scanners have identified malicious behavior associated with the host. The domain lacks publicly resolvable name‑server records, as the query returned NS_NOT_FOUND, which may be an evasion technique to hinder attribution. It is presently listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy mitigation service.

No additional intelligence such as page title, SSL certificate details, or HTTP response codes is available, leaving the exact content and lure technique undocumented. The elevated risk rating aligns with the detection count and the presence on a dedicated phishing blocklist. The absence of published TLS certificate data suggests that the service may be operating over HTTP, which further reduces the cost of deployment for the threat actor. No registrar information is present in the supplied intelligence, preventing confirmation of the registration date or potential abuse of privacy protection services. Defenders should add the domain and its resolved IP address to outbound filtering rules, ensure that internal DNS resolvers deny resolution, and monitor network traffic for connections to 188.114.96.3.

Continuous re‑scanning of the host is recommended to capture any changes in payload or hosting. Threat hunters should prioritize traffic analysis for the associated IP address and correlate any observed credential harvesting with known phishing patterns. Integration of this indicator into SIEM correlation rules will improve detection of downstream exploitation attempts.