apex-elevate[.]net[.]mercatorgenius[.]org

The domain apex-elevate.net.mercatorgenius.org was registered on June 27, 2025 through GoDaddy.com, LLC and resolves to the IPv4 address 198.12.66.123, which is hosted by AS36352 (HostPapa) in the United States. The authoritative nameservers are ns1.host-forest.com and ns2.host-forest.com. No TLS certificate is presented for the site, indicating that HTTPS is not enabled. A scan on VirusTotal reported that three of ninety‑five security vendors flagged the domain as malicious, and the site is listed on one public blocklist.

Independent filtering services, including PhishDestroy, have already blocked the domain. The page title returned by the HTTP response is "Welcome - Apex Elevate", and the Gridinsoft trust score is 0 out of 100, reinforcing the suspicion of malicious intent. The current operational status is offline, which may be the result of takedown actions or host‑side removal. Although the specific phishing payload or credential‑harvesting mechanism has not been publicly disclosed, the convergence of low trust scores, vendor detections, and blocklist listings strongly suggests a generic phishing campaign targeting users who might be lured by the "Apex Elevate" wording.

Defenders should continue to monitor DNS queries for the domain, ensure that any cached entries are purged, and update internal blocklists to include the listed IP address and domain. Network‑level egress controls that block connections to the identified IP range, along with email gateway filters that flag URLs associated with the domain, are recommended. Incident response teams should also verify that no credentials have been exfiltrated from internal users who may have visited the site before it was taken offline.