mervox[.]sbs

On 23 July 2026 analysts observed that the domain mervox.sbs, registered through Dynadot LLC on 4 December 2025, is associated with a generic phishing infrastructure. The host resolves to IP 46.151.182.165, which belongs to AS205759 operated by Ghosty Networks LLC and is geolocated to Luxembourg. The web server presents a Plesk Obsidian 18.0.74 panel, as indicated by the page title and the SSL certificate that identifies the vendor as Plesk.

The domain appears on one security blocklist and is listed in a single AlienVault OTX pulse, confirming prior threat‑intel sightings. VirusTotal scans report that fifteen of ninety‑three antivirus engines flagged the domain, reinforcing its malicious classification. Independent telemetry from PhishDestroy and Gridinsoft assigns a trust score of 0 out of 100, and both services have blocked the host.

As of the current check the domain is offline, preventing immediate probing, but the infrastructure remains resolvable. Defenders should add the domain and its IP address to block lists, monitor DNS queries for similar Plesk‑based panels, and consider tightening outbound filtering to prevent credential capture. Continued observation of any re‑hosting attempts is advised.