czdog-broccoli[.]entrance-cryptolist[.]com

Analysis indicates that the domain czdog-broccoli.entrance-cryptolist.com continues to operate as an active phishing infrastructure as of July 29, 2026. The domain was registered on June 17, 2024, through Key-Systems GmbH, a registrar frequently observed in phishing campaigns due to its domain privacy and bulk registration services. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, which is part of Cloudflare’s network, a common hosting choice for threat actors seeking to obscure server origins and evade IP-based blocking. The domain utilizes Cloudflare nameservers (daisy.ns.cloudflare.com and sri.ns.cloudflare.com), further leveraging the provider’s proxy services to mask backend hosting details.

Detection data from VirusTotal shows that 15 out of 91 security vendors have flagged this domain as malicious, though the specific nature of the phishing content remains unconfirmed. The domain appears on at least one security blocklist, and it is actively blocked by PhishDestroy, a specialized anti-phishing service. The HTTP status code 200 indicates the site is currently accessible, suggesting ongoing malicious activity. No additional details regarding the targeted brand, phishing kit, or scam type are available in the current intelligence, and the exact content of the site has not been analyzed.

Defenders should treat this domain as high-risk due to its active status, Cloudflare-hosted infrastructure, and detection by multiple security vendors. Network-level blocking of the domain and its associated IP (188.114.96.3) is recommended for organizations seeking to mitigate exposure. Given the domain’s registration age and continued accessibility, monitoring for further detection updates or shifts in hosting infrastructure is advised. The lack of widespread blocklist inclusion does not diminish the threat, as phishing domains often evade detection during early deployment phases.