subhub[.]entrance-cryptolist[.]com

The domain subhub.entrance-cryptolist.com is currently flagged as an active generic phishing site. Registration data shows it was created on June 17, 2024 through the registrar Key-Systems GmbH. The domain resolves to the IPv4 address 188.114.97.3 and uses Cloudflare authority with the nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. VirusTotal analysis reports that 17 of 91 security vendors have classified the domain as malicious, indicating a moderate level of consensus among scanning engines.

The domain is listed on one external security blocklist and is explicitly blocked by the PhishDestroy service, demonstrating that at least one dedicated anti‑phishing platform has taken mitigation action. No additional evidence such as page title, SSL certificate details, or explicit impersonated brand is presently available, so the precise phishing lure cannot be confirmed. Infrastructure analysis therefore relies on the observed resolution, registrar, detection counts, and blocklist presence.

Defensive recommendations include adding subhub.entrance-cryptolist.com to DNS and proxy blocklists, denying outbound connections to 188.114.97.3, and monitoring Cloudflare‑hosted subdomains that share the same nameserver pair for similar creation dates. Security teams should also incorporate the 17 vendor detections into SIEM correlation rules to raise alerts when traffic to this domain is observed. Continuous re‑evaluation is advised as additional threat intelligence, such as page content or victim reports, may emerge.