meritsinvestment[.]live

Analysis of meritsinvestment.live, created on 14 May 2026 and currently active, shows that the domain is already listed on a security blocklist and is actively blocked by PhishDestroy. DNS resolution points to the IPv4 address 50.6.200.60, and the authoritative name servers are ns1.meritsinvestment.live and ns2.meritsinvestment.live, both hosted under the same domain. Registration was performed through Dynadot Inc, a registrar that does not provide additional protective controls.

VirusTotal scans have returned detections from two of ninety‑one antivirus engines, indicating that at least a minority of security products have identified malicious behavior associated with the domain. The presence of detections, combined with the blocklist listing, strongly suggests that the site is being used for phishing, consistent with the generic phishing classification supplied. No further public metadata such as SSL certificate details, HTTP response codes, or page title have been disclosed, leaving the exact content of the site unverified.

Defenders should continue to enforce blocklist rules, ensure that traffic to 50.6.200.60 is denied at network perimeters, and monitor DNS queries for the domain and its name‑server records. Additional scrutiny through sandbox analysis or manual inspection of the live site is recommended to confirm the phishing payload and to capture any ancillary indicators such as malicious scripts or credential‑stealing forms. Organizations employing email filtering should add meritsinvestment.live to deny‑list rules, and threat‑intelligence platforms should update their indicators of compromise to include the domain, its IP address, and the two name‑server entries.