poom[.]entrance-cryptolist[.]com

Analysis on poom.entrance-cryptolist.com indicates active generic phishing infrastructure. The domain was registered on June 17, 2024 through Key-Systems GmbH and uses Cloudflare nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.3, which is the sole hosting endpoint observed. The domain appears on one external security blocklist and is currently listed by PhishDestroy, confirming that threat‑intelligence feeds have flagged it as malicious. VirusTotal has recorded 16 of 91 scanned security vendors labeling the domain as malicious, providing independent corroboration of its threat status.

The elevated risk rating reflects the combination of recent registration, limited detection history, and confirmed phishing classification. No publicly available page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the content of the landing page unverified. Consequently, analysts cannot confirm the exact phishing lure or target brand beyond the generic classification. The lack of additional observable indicators such as Safe Browsing status, OTX references, or further blocklist listings suggests a low‑profile deployment, but the existing detections warrant immediate mitigation.

Defenders should block poom.entrance-cryptolist.com at DNS and proxy layers, add the associated IP 188.114.97.3 to network deny lists, and monitor for any outbound connections to the address. Continuous re‑scanning on VirusTotal and periodic checks of Cloudflare name‑server records are recommended to capture potential infrastructure changes. Organizations using threat‑intel platforms should ingest the blocklist entry from PhishDestroy and correlate any internal alerts that reference the domain or IP. Ongoing observation is required because the domain remains active and may evolve its phishing payloads.