meritking5018[.]co

The domain meritking5018.co was registered on June 11, 2026 and is currently active. It resolves to the IP address 104.21.34.245, which is associated with a Cloudflare edge node, a common hosting choice for fast‑flux and abuse campaigns. The domain has been added to a single public blocklist and is actively blocked by the PhishDestroy sinkhole service, indicating that threat‑intel feeds have recognized it as malicious.

VirusTotal analysis shows that 12 of 91 scanned security vendors flagged the domain, suggesting a moderate level of confidence among AV engines that the site is involved in phishing or related fraudulent activity. No additional context such as page title, SSL certificate details, HTTP response codes, or explicit brand impersonation is available, so the precise lure employed by the site remains unknown. Defenders should prioritize immediate containment: add meritking5018.co to network and endpoint blocklists, enforce DNS sinkholing where possible, and monitor for any outbound connections to the hosting IP.

Given the recent creation date, the domain may be part of a short‑lived campaign; continuous telemetry collection is advised to detect any evolution in payload or target profile. Updating intrusion‑prevention signatures to include the domain and its IP, and sharing the indicator with upstream threat‑sharing platforms, will help reduce exposure across the organization.