merittipfxonline[.]com

The domain merittipfxonline.com was registered on 16 August 2025 through Global Domain Group LLC and is currently resolving to the IPv4 address 145.79.20.4. Authoritative name servers for the zone are aster.dns-parking.com and helios.dns-parking.com, both typical of parking‑service providers. The domain appears on a single public security blocklist and has been actively blocked by the PhishDestroy sink‑hole, indicating that at least one anti‑phishing feed has classified it as malicious.

VirusTotal records show that 7 of 91 scanning vendors have flagged the domain, providing independent confirmation of suspicious activity. The known intelligence does not include SSL certificate details, HTTP response codes, page titles, or any content analysis, so the precise payload or credential‑harvesting mechanism remains unverified. The combination of a recent creation date, active status, blocklist presence, and multiple vendor detections suggests the domain is being used in a generic phishing campaign, likely as a short‑lived redirect or landing page designed to capture user credentials.

Defenders should add the IP address 145.79.20.4 to network‑level deny lists, enforce DNS filtering for merittipfxonline.com, and monitor the associated name servers for rapid changes. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture any evolution of the site. Given the high‑risk rating, the domain should be treated as malicious until further forensic evidence can be obtained, and relevant IOCs should be shared with upstream filtering services and incident response teams.