merkl[.]pro

Analysis of the domain merkl.pro indicates active generic phishing infrastructure as of July 12, 2026. The domain resolves to the IP address 188.114.97.3, which is part of a network protected by Cloudflare, a common obfuscation tactic observed in phishing campaigns. The domain was registered through Cloudflare, Inc., a registrar frequently utilized by threat actors to mask ownership and hosting details. The page title, 'Success!', is consistent with placeholder or transitional pages often deployed in phishing operations to confirm successful redirection or payload delivery. Infrastructure analysis reveals the use of HTTP/3 and a SSL certificate issued by Google Trust Services, suggesting modern web protocols are employed to evade detection and enhance perceived legitimacy. The domain is currently flagged by two security blocklists and appears in 23 threat intelligence pulses on a public threat-sharing platform, indicating prior identification by multiple independent sources. Three of 95 security vendors on a multi-engine scanning platform have classified the domain as malicious, though the specific nature of the phishing content remains unconfirmed due to the absence of detailed page analysis. Defenders are advised to treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Given the use of Cloudflare-hosted infrastructure, traditional IP-based blocking may be ineffective; domain-based filtering or DNS sinkholing is recommended. The domain's continued activity suggests it remains operational, and further monitoring is warranted to assess evolving tactics or payloads. No brand-specific targeting or phishing kit has been identified in the available data, and the exact content of the page has not been analyzed.