predeposit-merkl[.]com

This domain, predeposit-merkl.com, is actively flagged as a high-risk credential phishing site. Analysis indicates it was registered on November 26, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. The domain currently resolves to the IPv6 address 2606:4700:3033::ac43:acfb, which is part of a network infrastructure known for hosting phishing and scam operations. The site is protected by Cloudflare, a common tactic to obscure hosting details and evade takedowns, and uses HTTP/3, a protocol that can complicate traffic inspection for security tools. The domain appears on two security blocklists and is flagged by 6 out of 95 security vendors in VirusTotal scans, confirming its malicious classification. Additionally, it has been included in 23 threat intelligence pulses on AlienVault OTX, suggesting widespread detection across multiple security communities. The page title, 'Just a moment...', is consistent with Cloudflare interstitial pages, which are often used to mask the true content of phishing sites until victims are redirected or granted access. No specific brand impersonation or scam category has been confirmed, but the infrastructure and detection patterns align with credential harvesting or fraudulent deposit schemes. Defenders should treat this domain as an active threat. The SSL certificate issued by Google Trust Services does not indicate legitimacy, as phishing sites routinely use valid certificates to appear trustworthy. Network-level blocking is recommended for the domain and its associated IP address. Security teams should monitor for connections to 2606:4700:3033::ac43:acfb and investigate any internal systems that interact with it. Given the domain's recent registration and persistent activity, it is likely part of an ongoing campaign, and further analysis of related infrastructure may uncover additional malicious domains.