m[.]meritking1-resmi[.]vip

Analysis as of July 29 2026 indicates that the sub‑domain m.meritking1-resmi.vip is actively being used for a generic phishing campaign. The domain was registered on June 11 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IPv4 address 188.114.96.3. VirusTotal has recorded 14 detections out of 91 scanning engines, confirming that multiple security vendors have observed malicious activity associated with the domain. It is listed on at least one public security blocklist and is specifically blocked by the PhishDestroy service, demonstrating that community‑driven defenses have already taken mitigation steps.

The limited public metadata does not reveal additional infrastructure details such as SSL certificate properties, HTTP response codes, or page titles, and no further analysis of the hosted content has been published. Consequently, the full scope of the phishing payload, targeted brand, or victim interaction flow remains uncertain. However, the convergence of recent registration, a dedicated hosting IP, multiple vendor detections, and inclusion on a phishing‑focused blocklist provides a clear indicator of compromise.

Defenders should treat any network traffic to or from m.meritking1-resmi.vip as malicious. Recommended actions include adding the domain to local blocklists, updating DNS filtering policies to deny resolution, and monitoring outbound connections to the associated IP address 188.114.96.3 for signs of data exfiltration. Incident response teams should also consider correlating user reports of credential‑theft attempts with this domain, and threat‑intel platforms should be updated to reflect its elevated risk status.