meritkinq-giris[.]com

The domain meritkinq-giris.com has been identified as a phishing site designed to impersonate Merit Network authentication portals. Analysis confirms this domain as a generic phishing threat targeting user credentials, likely through fraudulent login interfaces. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented security concern. Infrastructure analysis reveals the domain was registered on February 28, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.71.39, a Cloudflare-hosted endpoint leveraging HTTP/3 and Cloudflare Browser Insights for performance optimization. Detection metrics indicate limited but notable coverage: the domain appears on one security blocklist and is flagged by 2 of 95 vendors in aggregate scanning platforms. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as malicious. The page title, 'Index of /', suggests either misconfigured directory listing exposure or intentional obfuscation of phishing content. Current status confirms the domain has been rendered inaccessible, though residual risk persists for users who may have interacted with it during its active phase. Organizations and individuals are advised to monitor authentication logs for unauthorized access attempts originating from this domain or its associated IP. Network administrators should consider implementing DNS-based blocking for 104.21.71.39 and domains registered through NiceNIC with similar naming patterns. End users who may have entered credentials on this site should immediately rotate passwords and enable multi-factor authentication on all associated accounts. Proactive threat hunting for related infrastructure, particularly Cloudflare-hosted domains with anomalous registration dates, is recommended to identify potential follow-on campaigns.