mixmax[.]entrance-cryptolist[.]com

mixmax.entrance-cryptolist.com is an active domain observed in phishing campaigns. The zone is delegated to Cloudflare name servers daisy.ns.cloudflare.com and sri.ns.cloudflare.com and resolves to the IP address 188.114.96.3, a Cloudflare edge node. Registration data shows the domain was created on June 17, 2024 through the registrar Key-Systems GmbH. Reputation services have placed the domain on one security blocklist, and the anti‑phishing feed PhishDestroy currently lists it as blocked. VirusTotal analysis reports that 16 of 91 scanning engines flagged the domain as malicious, indicating a moderate consensus of detection.

The risk rating assigned by the reporting system is elevated, and the status remains active. Publicly available metadata does not include a page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts, so the exact content served by the site remains unverified. Likewise, no Open Threat Exchange (OTX) indicators or additional blocklist entries have been published. The lack of visible branding or a disclosed phishing kit prevents attribution to a specific campaign beyond the generic phishing classification.

Defenders should treat any traffic to or from mixmax.entrance-cryptolist.com as hostile. Recommended actions include adding the domain to network‑level deny lists, updating endpoint URL filtering policies, and monitoring DNS queries for the associated Cloudflare IP range. Because the domain is hosted on a shared Cloudflare infrastructure, blocking the IP could affect legitimate services, so precise domain‑based rules are preferred. Continuous re‑evaluation is advised as new intelligence, such as page content or additional vendor detections, may emerge.