m[.]meritking-guvenli[.]vip

This domain, m.meritking-guvenli.vip, is actively hosting a fake login phishing page targeting users of the Meritking platform. The page title, 'Meritking Güncel Giriş: Hızlı ve Güvenli Erişim Linki,' suggests an attempt to deceive users into entering credentials under the guise of a legitimate login portal. No cryptocurrency drainer kit signatures were identified, but the infrastructure aligns with credential harvesting campaigns targeting online gaming or betting platforms, a common vector for account takeover fraud. Analysis of technical indicators reveals the domain currently resolves to IP address 185.153.231.141 and lacks an SSL certificate, increasing exposure to interception risks. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious. The registrar details remain undisclosed, limiting attribution efforts. The domain appears on one security blocklist, and Google Safe Browsing (GSB) has not yet listed it as a known threat. No creation date was provided, but the active status and recent detection patterns suggest recent deployment. The phishing page remains operational as of the latest verification, posing an ongoing risk to users. While one security vendor has implemented blocking measures, the absence of broader blocklist inclusion and SSL encryption indicates gaps in detection coverage. Organizations are advised to update web filtering rules to include this domain and IP, monitor for credential reuse attempts, and alert users to verify login portals via official channels. The lack of SSL and low initial detection rate underscore the need for layered defenses, including endpoint protection and user education on phishing red flags.