cm304030111133[.]xhost[.]live

This domain cm304030111133.xhost.live is currently active and resolves to the IPv4 address 188.114.97.3. The authoritative nameserver lookup returned no records (NS_NOT_FOUND), which is often observed in fast‑flux or dynamically‑registered phishing infrastructure. The domain is listed on at least one public security blocklist and has been flagged by the PhishDestroy sinkhole service. VirusTotal analysis shows that 22 out of 91 scanned security vendors classify the domain as malicious, indicating a consensus among a subset of scanners that the site hosts or supports phishing content.

No additional metadata such as registrar information, SSL certificate details, HTTP response codes, or page title is available in the supplied intelligence, so the exact landing page and targeted brand remain unknown. Given the high‑risk rating and the active status, defenders should treat any traffic to this host as malicious. Network perimeter devices should block DNS resolution and outbound connections to 188.114.97.3. Endpoint security solutions should incorporate the domain and its IP into blocklists and enable real‑time URL filtering.

Incident response teams should monitor logs for any recent connections to the domain or IP, especially from user agents that commonly interact with phishing campaigns. Because the domain lacks published nameserver records, threat hunters may consider querying historical DNS data to identify related domains that share the same IP or hosting provider. Continuous re‑evaluation is advised, as the infrastructure could be repurposed or expanded.