mertikinghere-thera[.]com

The domain mertikinghere-thera.com is flagged as a high‑risk generic phishing infrastructure. It is hosted behind Cloudflare, resolving to IP 104.21.63.151, which maps to a Cloudflare data centre in Canada. Authoritative nameservers are bart.ns.cloudflare.com and magdalena.ns.cloudflare.com, indicating the domain is fully proxied through Cloudflare’s network. The site returns an HTTP 200 response while the page title reports “403 Forbidden,” suggesting a misconfiguration or intentional obfuscation of content. The SSL certificate is issued by Google Trust Services under the WE1 profile, confirming the use of a valid TLS certificate despite the malicious intent. VirusTotal analysis shows that 2 of 91 security vendors have flagged the domain, and it appears on one external blocklist. The domain is actively blocked by the PhishDestroy service and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. While the exact phishing payload or target brand has not been disclosed, the combination of a valid TLS certificate, Cloudflare front‑end, and detection by multiple security sources confirms the presence of a phishing operation. Defenders should add mertikinghere-thera.com to web‑filter deny lists, monitor DNS queries for the associated IP address, and enforce TLS inspection to capture any potential credential‑stealing traffic. Ongoing observation is recommended to detect any changes in page content or additional infrastructure deployments.