tr[.]meritking-sitegiris[.]com

The domain tr.meritking-sitegiris.com was registered on July 03, 2026 through Fewmoretaps OU d/b/a Trustname.com and remains active as of the report date, July 27, 2026. Infrastructure analysis shows the domain is hosted on Cloudflare’s network, using the authoritative nameservers stevie.ns.cloudflare.com and wilson.ns.cloudflare.com, and resolves to the IP address 104.21.13.203. The domain is listed on at least one public security blocklist and has been explicitly blocked by the PhishDestroy sinkhole, indicating that it is already recognized by threat‑mitigation services.

VirusTotal scans have recorded detections from two of ninety‑one security vendors, confirming that a minority of automated scanners have identified malicious characteristics, though the majority have not flagged the domain. No additional public data such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts are available, leaving the content and exact phishing lure unknown. Consequently, defenders should treat the domain as a high‑risk indicator.

Recommended actions include adding the domain and its resolving IP to outbound and inbound firewall deny lists, updating DNS filtering policies to block the associated Cloudflare nameservers, and monitoring for any traffic or authentication attempts to the domain. Organizations should also query threat‑intelligence platforms for any emerging indicators of compromise that reference tr.meritking-sitegiris.com, and consider sharing observed activity with community blocklists to improve collective detection. Continuous re‑evaluation is advised, as further analysis (e.g., page content retrieval, SSL fingerprinting, or sandbox execution) may reveal additional tactics, techniques, and procedures used by the actors behind this infrastructure.