maluo-token[.]entrance-cryptolist[.]com

maluo-token.entrance-cryptolist.com was observed as an active generic phishing infrastructure on 2026-07-29. The domain resolves to the IP address 188.114.96.3, which is an address owned by Cloudflare and commonly used for CDN and proxy services, making attribution to a backend server difficult. Registration data shows the domain was created on 2024-06-17 and is listed under the registrar Key-Systems GmbH, a provider known for handling a broad range of domain registrations. The authoritative nameservers are daisy.ns.cloudflare.com and sri.ns.cloudflare.com, confirming the use of Cloudflare’s DNS platform.

VirusTotal has recorded 14 of 91 security vendors flagging the domain as malicious, providing a moderate level of consensus that the site is being used for phishing activities. The threat has been categorized as generic phishing with an elevated risk rating and remains active in the intelligence feed. Defensive telemetry indicates that PhishDestroy has already blocked the domain and it appears on one external security blocklist, suggesting that some protective services are aware of its malicious intent.

No public Safe Browsing, OTX, or SSL/TLS fingerprint information is currently available, and the page title or content has not been captured, leaving the specific lure or impersonated brand unconfirmed. Given the limited but concrete evidence, security teams should add the domain and its resolved IP to outbound and inbound filtering rules, monitor DNS query logs for look‑ups to the Cloudflare nameservers, and consider sharing the indicator with threat‑sharing communities to improve collective detection. Continuous re‑evaluation is advised, as changes to the hosting or content could alter the risk profile.