bro-on-base[.]entrance-cryptolist[.]com

The domain bro-on-base.entrance-cryptolist.com was registered on June 17, 2024 through Key-Systems GmbH and is currently resolved to the Cloudflare IP address 188.114.96.3. The domain is served by the Cloudflare nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com, which obscures the underlying hosting infrastructure and limits passive attribution. VirusTotal has recorded 17 detections out of 91 security vendors, indicating that a notable minority of scanners have identified malicious characteristics associated with the domain. It is listed on a single public security blocklist and has been specifically flagged by the PhishDestroy blocklist, confirming that at least one dedicated phishing mitigation service has taken active measures against it.

The observed risk level is elevated and the operational status is active, suggesting ongoing malicious use. Defenders should immediately block outbound and inbound traffic to this fully qualified domain name at the network perimeter and within endpoint allow‑lists. Because the domain resolves to a shared Cloudflare address, any attempts to isolate the originating server via IP will likely affect unrelated legitimate services; therefore, domain‑level filtering is the preferred mitigation.

Continuous monitoring of DNS queries for the domain and its associated subdomains is advised, as well as periodic re‑scanning with updated threat intelligence feeds to capture any changes in detection ratios. Organizations should also review email gateway logs for any messages containing URLs that resolve to this domain, and quarantine or delete such messages. Given the registrar’s location and the use of Cloudflare’s CDN, rapid takedown requests may be less effective, so defensive controls remain the primary line of protection.