murm[.]vip

Analysis of murm.vip indicates that the domain is presently active and is being used for a generic phishing operation. The authoritative name servers are bjorn.ns.cloudflare.com and monroe.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare's DNS infrastructure. DNS resolution points to the IPv4 address 188.114.96.3, which is the sole address observed for the domain at the time of analysis. The domain appears on a single security blocklist; it is listed by PhishDestroy, which classifies it as a malicious phishing resource.

VirusTotal records show that the domain has been examined by 95 independent scanning engines, none of which reported a detection at the time of the scan. While the absence of detections does not constitute a safety guarantee, the combination of blocklist inclusion and the observed hosting profile suggests a malicious intent. The current status is marked as active, indicating that the phishing infrastructure is still operational. No additional intelligence such as registrar information, SSL certificate details, HTTP response codes, Safe Browsing verdicts, or OTX references is available in the supplied data set, leaving those aspects unverified.

Defenders should therefore treat murm.vip as a high‑confidence malicious indicator. Recommended mitigations include adding the domain and its resolved IP address (188.114.96.3) to deny lists, enforcing DNS sink‑hole policies for the associated nameservers, and monitoring outbound traffic for connections to the listed IP. Continuous re‑evaluation is advised, as future scans may reveal new detections or changes in hosting configuration.