ceoglobalearnings[.]xyz[.]satrixmarket[.]live

This domain, www.ceoglobalearnings.xyz.satrixmarket.live, was observed hosting a brand‑impersonation page titled “CEO Global Earnings | International Investment Corporate Company Limited”. The site resolved to the IP address 192.3.190.186, which belongs to AS36352 HostPapa in the United States. DNS resolution was provided by dns1.webproserver.com and dns2.webproserver.com, and the registrar listed is OwnRegistrar, Inc. No TLS certificate was present, indicating the site operated over plain HTTP. Static analysis revealed the use of common web‑stack components including Bootstrap, LiteSpeed, Smartsupp, OWL Carousel, jQuery, GetButton, and HTTP/3 support.

VirusTotal scans show that seven of ninety‑five security vendors flagged the domain as malicious. The domain is currently listed on a single security blocklist and has been blocked by the PhishDestroy service. The infrastructure is offline at the time of reporting, but the historical footprint suggests a low‑cost hosting setup typical of opportunistic impersonation campaigns.

Defensive teams should add the fully qualified domain name and its associated A‑record (192.3.190.186) to outbound and inbound filtering rules, monitor for any resurgence of the same IP or nameserver pair, and ensure web‑proxy and DNS security solutions reference the PhishDestroy blocklist. Because the page title explicitly references “International Investment Corporate Company Limited”, any email or web traffic purporting to originate from that brand should be scrutinized for the presence of this domain or similar look‑alike constructions. Continuous threat‑intel feeds should be consulted for any new indicators of compromise related to the hosting provider or the observed technology stack, and organizations should consider reporting any future sightings to relevant abuse contacts.