mertiking50733[.]com

This domain, mertiking50733.com, is flagged as an active phishing portal impersonating Meritking, a recognized brand in the online gaming and betting sector. Analysis indicates the site presents itself as the "Meritking 2026 Resmi Erişim Portalı" (Official Access Portal), targeting Turkish-speaking users with promises of original links, mobile login sessions, and updated address directories. The threat type is classified as brand impersonation with credential harvesting objectives, though no direct evidence of a cryptocurrency drainer kit has been observed at this stage. The page title and content structure suggest an attempt to deceive users into submitting login credentials under the guise of legitimate access. Infrastructure analysis reveals the domain was registered on June 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 172.67.170.145, which is hosted on a content delivery network known for providing anonymity and resilience against takedowns. As of the latest scan, the domain has a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it as malicious. However, it appears on one security blocklist, suggesting preliminary awareness within the threat intelligence community. Google Safe Browsing does not currently list the domain, leaving potential victims without browser-level warnings. The domain remains active and operational, with no signs of suspension or mitigation efforts. Response actions by hosting providers or registrars have not been observed, and the site continues to resolve normally. The absence of detections on major scanning platforms, combined with the use of a content delivery network, increases the risk of prolonged undetected operation. Users are advised to avoid interaction with the domain, verify the authenticity of any Meritking-related communications through official channels, and report the domain to relevant abuse contacts for further investigation. Organizations should monitor for credential leaks associated with this campaign and consider proactive blocklisting of the domain and IP address.