merkl-xyz[.]com

The domain merkl-xyz.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and currently resolves to the Cloudflare edge address 172.67.144.58, which is advertised as being hosted in the United States under ASN 13335. The site presents an HTTP 403 response and delivers a page whose title is limited to the phrase “Just a moment…”. TLS termination is provided by Google Trust Services under the WE1 certificate, and the connection is protected by HSTS, HTTP/3 and Cloudflare Browser Insights, indicating that the domain is behind Cloudflare’s reverse‑proxy infrastructure. Nameserver configuration lists diana.ns.cloudflare.com and oswald.ns.cloudflare.com, confirming the Cloudflare association.

Reputation checks show the domain appears on a single public blocklist and is actively listed by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records four detections out of 93 scanned engines, reinforcing the malicious classification. No additional open‑source threat feeds (e.g., OTX) or Safe Browsing entries were observed at the time of analysis. The evidence points to a high‑risk generic phishing operation, though the exact phishing lure or targeted brand has not been disclosed.

The lack of visible content beyond the generic title and the use of a 403 status suggest the site may be serving a payload only after additional checks, a technique commonly employed to evade automated scanners. Defenders should block any outbound connections to 172.67.144.58, enforce DNS filtering for merkl-xyz.com, and monitor for credential‑harvesting attempts that reference the domain. Continuous re‑scanning with multi‑engine services is advised to capture any evolution of the payload, and any detection should be escalated to incident‑response teams for containment.