# PhishDestroy threat dossier — m.meritking-onlineeadress.cam ================================================================ Fetched: 2026-06-30 01:28:51 UTC Canonical: https://phishdestroy.io/domain/m.meritking-onlineeadress.cam/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 78/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: Fortinet, PhishFort Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (US, San Francisco) ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Hosting org: AS13335 Cloudflare, Inc. Registrar: DYNADOT LLC Nameservers: mira.ns.cloudflare.com, yisroel.ns.cloudflare.com Registered: 2026-06-21 Expires: 2027-06-21 Page title: Meritking (Anında Erişim, Yüksek Oranlar) 2026 Güncel Giriş Adresi – Meritking Kesintisiz Bağlantı, Özel Bonuslar ve Premium Casino Oyunları ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-09-19 Status: INVALID chain Fingerprint: 9deb9a45b058edc0e58072bf1cacb9a6441539c38ec44d2e24a474a70cdc0920 Subject Alternative Names (related infrastructure — often same operator): - meritking-onlineeadress.cam ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-21 18:44:46 UTC (by PhishDestroy tracker) First reported: 2026-06-21 16:46:29 UTC (abuse notice filed) Last verified: 2026-06-30 00:20:34 UTC Neutralised: 2026-06-26 06:17:44 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019eeb11-2e61-7555-92e6-547890e2a1f4/ URLQuery: https://urlquery.net/report/1229e48f-b5c3-42d6-bf30-dd41d7376e73 Wayback Machine: https://web.archive.org/web/*/m.meritking-onlineeadress.cam crt.sh CT logs: https://crt.sh/?q=%25.m.meritking-onlineeadress.cam Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=m.meritking-onlineeadress.cam AlienVault OTX: https://otx.alienvault.com/indicator/domain/m.meritking-onlineeadress.cam URLhaus: https://urlhaus.abuse.ch/host/m.meritking-onlineeadress.cam/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 17:58:37 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain poses as Meritking, a known online casino brand, to steal user login credentials and financial details. Visitors are presented with a fraudulent login page titled 'Meritking (Anında Erişim, Yüksek Oranlar) 2026 Güncel Giriş Adresi – Meritking Kesintisiz Bağlantı, Özel Bonuslar ve Premium Casino Oyunları,' designed to harvest sensitive account information under the guise of offering casino access and bonuses. The site targets users seeking legitimate gambling platforms, exploiting trust in the Meritking brand to facilitate unauthorized access to personal and financial data. Analysis indicates the domain was registered on June 21, 2026, through DYNADOT LLC, a registrar frequently associated with malicious infrastructure. It resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), which is commonly used to obfuscate the true origin of phishing sites. The domain is flagged by 2 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate, issued by Google Trust Services, provides a false sense of security while the site actively engages in credential theft. If you visited m.meritking-onlineeadress.cam or entered any credentials, immediately change passwords for all associated accounts, especially those linked to financial services or email. Enable multi-factor authentication where available to add an extra layer of security. Monitor bank and casino accounts for unauthorized transactions, and report any suspicious activity to the legitimate Meritking platform. Avoid interacting with the domain or any links associated with it, and consider using browser-based security tools to block access to known malicious sites. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260621-E4967F Favicon MD5: 7e9031041b322c6b2fb5bb4b58fd8f21 TLS cert SHA-256: 9deb9a45b058edc0e58072bf1cacb9a6441539c38ec44d2e24a474a70cdc0920 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/m.meritking-onlineeadress.cam/ JSON API: https://api.destroy.tools/v1/check?domain=m.meritking-onlineeadress.cam Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,677 domains (13,021 alive under monitoring, 159,066 confirmed takedowns/dead). Site: https://phishdestroy.io