bob-the-builder[.]entrance-cryptolist[.]com

Analysis of bob-the-builder.entrance-cryptolist.com indicates that the domain is actively used for generic phishing and is currently classified as elevated risk. The domain was registered on June 17, 2024 through Key-Systems GmbH, a registrar that appears in multiple abuse reports. Infrastructure inspection shows the domain resolves to the IP address 188.114.96.3, which is owned by Cloudflare and is served by the nameservers daisy.ns.cloudflare.com and sri.ns.cloudflare.com. Cloudflare hosting is a common choice for threat actors seeking rapid deployment and DDoS mitigation, but it does not in itself imply benign use.

The domain has been blocked by the PhishDestroy sinkhole, confirming that at least one security organization has observed malicious activity originating from it. VirusTotal scans report that 15 out of 91 security vendors flag the domain as malicious, providing a modest consensus of detection across multiple engines. Additionally, the domain appears on one external security blocklist, further reinforcing its classification as hostile.

No public Safe Browsing, OTX, or additional blocklist entries are available in the current data set, and the page title or content has not been captured, leaving the exact phishing lure unspecified. Defenders should prioritize adding bob-the-builder.entrance-cryptolist.com to network and endpoint blocklists, monitor DNS queries for the associated IP address, and consider enforcing stricter outbound controls to Cloudflare‑hosted resources when they are not required for legitimate services. Continuous re‑evaluation is advised, as further telemetry may reveal additional indicators such as payload delivery methods or targeted brands.