dok[.]entry-cryptolist[.]app

The domain dok.entry-cryptolist.app is currently classified as a generic phishing site with an elevated risk rating and remains active as of the report date, July 29 2026. Intelligence sources indicate that the domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one protective platform has taken mitigation action. DNS resolution points to the IP address 188.114.96.3; no nameserver records were returned during the lookup, which may suggest an intentionally minimal or obscured DNS configuration.

VirusTotal analysis shows that 13 of 91 scanned security vendors flagged the domain, providing a modest consensus of maliciousness across the scanning community. The presence of multiple vendor detections, combined with the blocklist entry, strengthens the confidence that the domain is being used for phishing attempts, although the exact phishing payload or target page content has not been publicly disclosed. Because the available data does not include details such as SSL certificate status, HTTP response codes, or page titles, the full scope of the site’s behavior remains uncertain.

Defenders should update perimeter defenses to block both the domain and its resolved IP address, incorporate the domain into DNS and URL filtering policies, and monitor network traffic for connections to 188.114.96.3. Continuous re‑evaluation is advised, as additional detections or blocklist entries may emerge, refining the threat posture of this infrastructure.