meritgirisim[.]vip

The domain meritgirisim.vip is confirmed as active as of the report date, July 24 2026, and resolves to the IPv4 address 185.50.70.10. The IP is announced by AS208425 belonging to Osbil Technology Ltd. and is geolocated to Turkey. The hosting infrastructure uses Nginx with OpenResty and PHP, as identified by technology fingerprinting. The site presents a valid SSL certificate issued by Let’s Encrypt (certificate identifier E8), indicating that HTTPS connections are encrypted but does not guarantee legitimacy.

HTTP probing returned a 200 OK status, and the page title reported by the scanner is "Site Yapım Aşamasındadır," which translates to "Site Under Construction" in Turkish; no further content analysis is available. The domain was registered on February 21 2026 through NiceNIC International Group Co., Limited, and the authoritative name servers are ns1.yoncu.com and ns2.yoncu.com. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on one known security blocklist, and PhishDestroy has already listed it as blocked. VirusTotal analysis shows that three of ninety‑three security vendors flagged the domain, reinforcing the suspicion.

Although the exact phishing payload or target brand is not disclosed, the combination of a recently created domain, low trust score, blocklist presence, and partial vendor detections strongly indicates a phishing threat. Defenders should consider immediate blocking of the domain and its resolved IP at perimeter and DNS filtering points, monitor for any related C2 traffic from the same ASN, and add the nameservers to watchlists for future registrations. Continuous re‑scanning is advised to capture any changes in content or additional detections.