morepay[.]live

On July 27 2026 the domain morepay.live was observed delivering a generic phishing operation. The site returns HTTP 200 responses, indicating an active web server. DNS resolution is delegated to ns5.asurahosting.com and ns6.asurahosting.com, both hosted by Asura Hosting. Registration information shows the domain was created through Dynadot Inc, a registrar frequently used by threat actors.

The domain is presently listed on one security blocklist and has been flagged by the PhishDestroy feed, confirming that defensive platforms are already blocking it. VirusTotal analysis reports that 15 of 91 scanning engines label the domain as malicious, providing independent corroboration of its phishing nature. No additional contextual data such as page title, SSL certificate details, or targeted brand information is available from the current intelligence set, leaving the exact lure and victim profile uncertain.

Defenders should continue to enforce blocklist rules for the domain, monitor DNS queries for the associated nameservers, and consider adding the domain to internal URL filtering policies. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advisable to capture any changes in detection rates. Because the domain remains active, any inbound traffic should be treated as hostile and terminated or redirected to a safe‑browse warning page.