# mrekl.xyz — SUSPICIOUS

> mrekl.xyz is a newly registered phishing domain (Dec 8, 2025) mimicking a trusted brand. Flagged by 0 of 95 VirusTotal vendors, users should avoid interacting.

## Summary
PhishDestroy identifies mrekl.xyz as a generic phishing domain currently under investigation for active brand impersonation. The domain was registered on December 8, 2025, and currently exhibits suspicious behavior warranting further analysis.

This domain was flagged by 0 of 95 VirusTotal vendors, is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 172.67.199.44. The domain has a valid SSL certificate issued by Google Trust Services and was created on December 8, 2025. While no blocklist detections are recorded at this time, the absence of VirusTotal coverage suggests a newly emerged threat that may not yet be widely recognized.

Currently, mrekl.xyz remains active but under investigation. Users should avoid accessing this domain or entering any credentials. Security teams are advised to block this domain at the network perimeter and monitor for related infrastructure. Immediate reporting to threat intelligence platforms is recommended to aid in rapid takedown efforts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-12-08 16:21:13
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.199.44

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/mrekl.xyz
- PhishDestroy: https://phishdestroy.io/domain/mrekl.xyz/
- LLM endpoint: https://phishdestroy.io/domain/mrekl.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/mrekl.xyz/
Last updated: 2026-04-07