mercurydigitalholdings[.]com

Analysis of mercurydigitalholdings.com confirms its classification as an active credential-theft phishing domain. Registered on February 21, 2026, through Dynadot LLC, the domain currently resolves to IP address 198.251.89.220, hosted on AS53667 (FranTech Solutions) in the United States. The infrastructure employs PHP, LiteSpeed web server, jQuery, JivoChat, and Google Hosted Libraries, with HTTP/3 support detected. A 307 HTTP redirect status is present, a technique often used to obscure malicious intent or chain to further phishing pages. Security vendors have flagged the domain, with 12 of 93 engines on VirusTotal identifying it as malicious. Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist, including PhishDestroy. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its free and automated nature. Nameservers ns27.my-control-panel.com and ns28.my-control-panel.com are used, which have been observed in other phishing campaigns but are not inherently malicious on their own. The page title matches the domain name, offering no immediate indication of a targeted brand or service. No specific phishing kit or impersonated entity has been confirmed at this time. Defenders should treat this domain as high-risk and prioritize blocking at the DNS or network level. Monitoring for related subdomains or newly registered domains under the same nameserver infrastructure may reveal additional threats. Given the domain's recent registration and active status, further infrastructure or campaign expansion is likely.