strawberry-in-bloom[.]entrance-cryptolist[.]com

The domain strawberry-in-bloom.entrance-cryptolist.com was registered on June 17, 2024 through Key-Systems GmbH and resolves to the IP address 188.114.96.3. The IP belongs to a Cloudflare edge node, as indicated by the authoritative nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. VirusTotal analysis shows that 17 of 91 security vendors have flagged the domain, suggesting that a portion of the threat‑intelligence community considers it malicious.

The domain is already listed on a security blocklist and has been actively blocked by the PhishDestroy service, confirming that at least one protective product has taken mitigation action. No public page title, SSL certificate details, HTTP status code, or Safe Browsing verdict are present in the supplied intelligence, leaving the exact appearance of the hosted content unknown. Consequently, defenders cannot verify the specific landing‑page behavior or the credential‑capture mechanisms employed, only that the infrastructure is consistent with a phishing operation.

Recommendations for security teams include adding the domain and its resolving IP (188.114.96.3) to DNS blocklists and firewall deny lists, monitoring for any new resolution patterns that might indicate a shift to alternative hosting, and correlating internal logs for any user‑initiated connections to the domain or its Cloudflare edge IP. Continuous re‑scanning with multi‑vendor services is advised to capture any future changes in detection status, and threat‑intel feeds should be refreshed to capture additional blocklist entries or URL‑based indicators that may emerge as the campaign evolves.