xcosttmer-dnaidnoz[.]rodioun[.]biz[.]id

Analysis of the host xcosttmer-dnaidnoz.rodioun.biz.id shows that it resolves to the IPv4 address 188.114.97.3. DNS queries return no usable nameserver records, indicating that the authoritative name servers are either hidden or misconfigured. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reflecting that at least one reputable anti‑phishing vendor has categorized the infrastructure as malicious. VirusTotal has processed the domain and 15 of the 91 scanning engines submitted a detection, reinforcing the suspicion of a phishing campaign.

No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange references, registrar details, autonomous system numbers, country attribution, SSL certificate information, HTTP response codes, or page title data is currently available. Consequently the precise brand or service being spoofed cannot be confirmed from the public evidence. Defenders should treat the domain as hostile and add it to deny‑list rules on perimeter firewalls, DNS filtering appliances, and endpoint web‑content controls. Network traffic destined for 188.114.97.3 should be logged and, where possible, dropped.

Email gateways that encounter URLs pointing to this host ought to quarantine the message and alert users to the potential credential‑ harvesting attempt. Continuous monitoring of threat‑intel feeds for new detections related to the IP address or adjacent domains is advised, as adversaries frequently reuse hosting resources. Internal security teams should also review recent authentication logs for signs of compromised credentials that might have been submitted to this site, and enforce multi‑factor authentication to mitigate the impact of any potential credential leakage.