project-hive[.]entrance-cryptolist[.]com

The domain project-hive.entrance-cryptolist.com is currently classified as an active generic phishing infrastructure with an elevated risk rating. VirusTotal records show that 17 of 91 security vendors have flagged the domain, indicating a consensus among multiple scanners that the site hosts malicious content or behavior. The domain is already blocked by the PhishDestroy filtering service and appears on one external security blocklist, reinforcing the detection confidence. Registration data reveal that the domain was created on 17 June 2024 through Key-Systems GmbH, a registrar known for handling a broad range of domain registrations.

DNS resolution points to the IPv4 address 188.114.97.3, and the authoritative nameservers are daisy.ns.cloudflare.com and sri.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare’s CDN and DDoS mitigation platform. No publicly available SSL/TLS certificate details, HTTP status codes, or page title information have been disclosed, leaving the exact content and targeted brand of the phishing page unverified. This lack of visible page metadata creates uncertainty about the specific lure employed, but the multi‑vendor detection and recent creation date suggest a purpose‑built campaign.

Defenders should treat the domain as malicious: add it to DNS and proxy deny lists, block outbound traffic to the associated IP address, and monitor for any new DNS queries or HTTP requests targeting the same host. Continuous tracking of VirusTotal updates and any emerging blocklist entries is advised to capture evolving threat indicators. Given the elevated risk assessment, organizations are recommended to enforce strict email filtering for messages containing similar URL patterns and to isolate any internal systems that may have interacted with the domain pending further forensic analysis.