app[.]merkl[.]today
Ringkasan bukti
Analysis of the domain app.merkl.today, registered on February 27, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, indicates infrastructure associated with phishing activity targeting cryptocurrency users. The domain was taken offline by the time of this assessment on July 22, 2026, but prior telemetry shows it resolved to 104.21.57.60, a Cloudflare IP (AS13335) located in the US. Nameservers audrey.ns.cloudflare.com and rohin.ns.cloudflare.com confirm Cloudflare hosting, a common choice for both legitimate services and threat actors due to its proxy capabilities. No SSL certificate was detected, which is unusual for modern web services but not uncommon in low-effort phishing setups.
The domain appeared on one security blocklist, specifically PhishDestroy, though no additional public threat feeds or vendor detections were recorded at the time of analysis. The page title 'Just a moment...' aligns with Cloudflare's default challenge page, suggesting the site may have been behind Cloudflare's anti-bot protections or was in the process of being stood up. The absence of detections from VirusTotal's 93 scanned vendors does not confirm safety, as phishing domains often evade detection during early deployment or when targeting niche audiences. Defenders should treat this domain as suspicious based on its registration context, hosting pattern, and blocklist presence.
While the exact content and target brand remain unconfirmed, the use of 'merkl' in the subdomain suggests a potential focus on cryptocurrency or DeFi platforms, where 'merkle' or 'merkl' are common technical terms. Network defenders are advised to review logs for connections to 104.21.57.60 or the domain itself, particularly from endpoints handling financial or crypto-related transactions. If the domain reappears, further analysis of its HTTP responses, certificate transparency logs, and associated infrastructure is recommended to determine intent and potential brand impersonation.
Snapshot bukti yang dikirim
- Dikirim
- Catatan buku besar
- 1
- ID kasus
PD-20260227-7FF290- Judul halaman yang direkam
- Just a moment...
- Artefak PDF
- Bukti PDF
Teks bukti lengkap
Policy Violations: Explicit policy to immediately suspend domains used for phishing, 419 scams, identity fraud, malware distribution without prior notice
Applicable Laws: IT Act 2000 §§66C–66D (identity theft, cheating by personation), Indian Penal Code §420 / Bharatiya Nyaya Sanhita §318 (fraud)
Data Coverage
Intelijen Keamanan Jaringan
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| DNS4EU | app.merkl.today |
malicious | Sinkholed |
Alur Tanggapan Ancaman Pipeline
Cakupan daftar blokir
10 sumber eksternal dipantau · snapshot tersimpan 12/08/2026
Linimasa deteksi
-
Cloudflare Radar
Pemindaian Cloudflare Radar tersimpan · Buka pemindaian
Tangkapan tersimpan
Intelijen Domain
Detail teknisDNS, nama TLS, dan stempel waktu
ICANN OVERSIGHT
Registration: merkl.today
Akreditasi dan konteks RAA
Akreditasi dan konteks RAA
Registrar accreditation and DNS abuse obligations
For the registrable domain merkl.today behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Analisis VirusTotal
Apakah Anda Terpengaruh oleh Situs Ini?
Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.
Laporkan kepada Pihak Berwenang di Daerah Anda
Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.
Periksa Domain Apa Pun
Analisis ancaman menggunakan daftar blokir yang disimpan, WHOIS, DNS, dan bukti pemindaian publik
Pindai SekarangLaporkan Phishing
Laporkan domain yang mencurigakan ke basis data ancaman kami — lindungi komunitas
LaporanPemberitahuan Ancaman Real-Time
Laporan phishing terbaru dan perubahan ketersediaan yang diamati
PantauTetap Terinformasi, Tetap Aman
Pantau ancaman secara langsung atau ajukan keberatan terhadap daftar ini jika Anda yakin ini merupakan false positive