meritt-king-xaktif[.]net

This domain is flagged as a high-risk credential harvesting phishing endpoint designed to deceive users into submitting sensitive authentication details. Analysis indicates the infrastructure is specifically engineered to mimic legitimate financial service portals, with observed patterns of collecting login credentials, multi-factor authentication codes, and personal identification information for subsequent unauthorized account access or identity fraud operations. Infrastructure analysis reveals the domain meritt-king-xaktif.net was registered on June 03, 2026 through Sav.com, LLC, an entity frequently observed in phishing campaign registrations. The domain currently resolves to the IP address 130.12.180.239, which has been associated with multiple confirmed phishing endpoints in recent threat intelligence reports. Security vendor detection metrics show 11 out of 95 engines on VirusTotal have flagged this domain as malicious, with additional presence on one security blocklist. The site presents an exposed directory listing with the page title 'Index of /', suggesting either misconfigured deployment or intentional exposure of backend resources to facilitate credential harvesting operations. The SSL certificate is issued by ZeroSSL, a provider commonly utilized in both legitimate and malicious deployments, with the specific certificate chain 'ZeroSSL RSA Domain Secure Site CA' observed in this instance. Mitigation against this credential harvesting threat requires immediate implementation of technical controls and user awareness protocols. Network-level protections should include DNS sinkholing for the domain meritt-king-xaktif.net and IP address 130.12.180.239, with corresponding firewall rules to block all outbound connections to these indicators. Organizations should deploy web filtering solutions capable of detecting and blocking exposed directory listings and known phishing page structures. Endpoint protection systems must be configured to alert on any process attempting to establish connections to the identified infrastructure. User education initiatives should emphasize verification of domain authenticity before credential submission, particularly for financial service portals, with specific guidance on identifying exposed directory listings as potential phishing indicators. Security teams are advised to monitor for any successful connections to this infrastructure within their networks and initiate immediate credential rotation protocols for affected accounts.