subwaybasedetail[.]buzz

The domain subwaybasedetail.buzz was registered on February 21, 2026 and is currently listed as offline. DNS resolution points to the Cloudflare‑managed address 188.114.96.3, which belongs to AS13335 in the United States. The authoritative nameservers are trevor.ns.cloudflare.com and harmony.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. An SSL certificate issued by GTS CA 1P5 is presented for the site, indicating that HTTPS is enabled but does not provide any assurance of legitimacy.

The page title returned by the server is "Hotel Renew CollectionHotel Renew Collection," which does not correspond to a known brand and suggests a possible attempt to lure users with unrelated content. The domain has been blocked by the PhishDestroy service and appears on one external security blocklist, reinforcing the assessment that it is being used for malicious purposes. VirusTotal reports indicate that the site was scanned by 93 antivirus and URL‑filtering vendors, and at the time of analysis no vendor flagged the content; however, the absence of detections is not evidence of safety and may reflect a lack of current signatures for this specific campaign. The available intelligence classifies the activity as brand impersonation under a generic phishing category, but no further details about the payload, credential‑stealing forms, or redirect behavior have been observed.

Because the site is offline, active verification of its content is not possible, leaving the exact nature of the phishing lure uncertain. Defenders should continue to block subwaybasedetail.buzz at the network perimeter, add the domain to URL filtering and threat‑intel feeds, and monitor for any re‑appearance or related infrastructure that may reuse the same IP address or Cloudflare nameservers. Ongoing observation of the associated IP block and periodic rescans on VirusTotal are recommended to capture any future changes in malicious behavior.