tr[.]merittking-tr-aktif[.]icu

The domain tr.merittking-tr-aktif.icu is identified as a phishing infrastructure specifically designed to impersonate Meritking, a recognized brand, with the intent of harvesting user login credentials. Analysis confirms this as a credential theft operation, presenting a fraudulent login portal under the guise of an official entry point for the service. The page title, "Meritking – Meritking Güncel Giriş Adresi 2026 - Meritking Orjinal," explicitly mimics legitimate Meritking branding to deceive users into submitting sensitive information. Infrastructure analysis reveals the domain was registered through Dynadot Inc on June 11, 2026, and resolves to the IP address 130.12.180.239. It is flagged by 6 of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources. The domain appears on two security blocklists, including PhishDestroy and OISD, and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by ZeroSSL, a common choice for low-reputation or malicious domains due to its accessibility. As of the latest assessment, tr.merittking-tr-aktif.icu has been taken offline, reducing immediate risk to users. However, organizations and individuals are advised to block the domain and its associated IP (130.12.180.239) at the network level to prevent potential re-emergence. Users who may have interacted with the site should reset credentials immediately and monitor accounts for unauthorized activity. Security teams should review logs for connections to the domain or IP and update detection rules to include this infrastructure in future threat hunting efforts.