m[.]resmi-meritking[.]vip

This domain, m.resmi-meritking.vip, is assessed as an elevated-risk phishing infrastructure targeting users of MeritKing, as suggested by the domain name and the German-language page title 'Nur einen Moment…' observed in the data. Analysis indicates the domain was registered on June 22, 2026, through DYNADOT LLC and is currently offline. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers amir.ns.cloudflare.com and margaret.ns.cloudflare.com, resolving to IP 172.67.193.29. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare’s proxy. The domain appears on one security blocklist and is flagged by PhishDestroy, though VirusTotal shows only one detection out of 91 vendors, suggesting limited visibility or recent takedown efforts.

The page title, while not conclusive, aligns with temporary holding or interstitial pages often used in phishing campaigns to evade initial detection before redirecting victims to credential-harvesting forms. No evidence of a specific phishing kit or additional brand impersonation is present in the available data. Defenders should treat this domain as compromised infrastructure. The Cloudflare proxy obscures the origin server, limiting further network-based attribution.

Given the domain’s recent registration and offline status, it may have been taken down proactively or abandoned after detection. Security teams should monitor for re-registration or related domains using the same registrar or hosting patterns. If internal logs show user traffic to this domain, investigate for credential exposure or follow-on compromise. Block the domain and IP at perimeter defenses, and consider sinkholing DNS requests to prevent accidental access during potential reactivation.