Analysis of mercadonaslots.com indicates an active phishing domain registered on July 29, 2026, through DEVEXPANSE LTD d/b/a Regery.com. The domain currently resolves to IP address 172.67.182.1, hosted on Cloudflare nameservers chad.ns.cloudflare.com and gwen.ns.cloudflare.com. As of July 30, 2026, the domain appears on one security blocklist (PhishDestroy), though it remains unflagged by all 91 vendors in the most recent VirusTotal scan. The absence of detections in VirusTotal does not confirm safety, particularly given the domain's recent registration and active status.
Infrastructure analysis reveals Cloudflare hosting, which may obscure the true origin of the malicious content. The domain's name suggests an attempt to impersonate Mercado Pago, a widely used payment platform, though no direct evidence of the site's content or specific phishing kit has been confirmed at this time. The page title and exact nature of the phishing scheme remain unanalyzed, as the site has not been directly inspected.
Defenders should treat this domain as high-risk due to its recent registration, use of Cloudflare for potential obfuscation, and presence on at least one security blocklist. Recommended actions include blocking the domain and associated IP (172.67.182.1) at the network level, monitoring for related domains registered through the same registrar, and alerting users to potential phishing attempts referencing Mercado Pago or similar financial services. Further investigation is required to determine the full scope of the threat, including any credential harvesting or fraudulent transaction activity.