merkl[.]sbs

This domain, merkl.sbs, is identified as a phishing site designed to mimic Cloudflare verification pages, commonly used to deceive users into completing fraudulent security checks. The page displays a generic 'Just a moment...' title, a tactic often employed to simulate legitimate security challenges while harvesting sensitive credentials or deploying malicious scripts. Such schemes frequently target users accessing cryptocurrency platforms, financial services, or corporate login portals, where security verification prompts are expected, increasing the likelihood of successful deception. Analysis of the domain infrastructure reveals multiple high-confidence indicators of compromise. The domain was registered on March 04, 2026, an unusually forward-dated creation that aligns with patterns observed in disposable phishing domains. VirusTotal reports 6 out of 95 security vendors flagging merkl.sbs as malicious, while it appears on one security blocklist. The domain resolves to the IP address 188.114.96.3 and was registered through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains due to its lenient registration policies and lack of stringent abuse controls. Users who visited merkl.sbs should immediately terminate any active sessions and avoid interacting with the site. If credentials or personal information were entered, affected individuals must change passwords for all associated accounts, particularly those linked to financial or cryptocurrency services. Devices used to access the domain should undergo a full security scan to detect potential malware or unauthorized scripts. Additionally, monitoring for unauthorized transactions or account activity is strongly advised, as phishing sites of this nature often deploy secondary payloads or credential-stealing malware. Network-level blocking of the domain and its associated IP address is recommended to prevent further exposure.