mertkings-guncel-adress[.]com

This domain, mertkings-guncel-adress.com, is flagged as a high-risk credential harvesting phishing site targeting users of the Meritking platform. Analysis of the page title, 'Meritking Güncel İstasyonu - 2500 TL Bakiyeli Meritking Yeni Adres,' indicates an attempt to deceive victims by impersonating an official Meritking update portal, likely to harvest login credentials or financial information. No specific drainer kit signatures were identified in initial scans, though the lures suggest a focus on account takeover or fraudulent balance transfers. Infrastructure analysis reveals the domain was registered on June 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing campaigns. The domain resolves to IP address 172.67.219.225, which is hosted on a content delivery network, obscuring the true origin. VirusTotal detections show 1 of 95 security vendors flagging the domain, while it appears on one additional security blocklist. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. Google Safe Browsing status remains unconfirmed in available data, but the low detection rate suggests evasion techniques may be in use. As of the latest assessment, the domain remains active and unresolved by major takedown efforts. The combination of a recent registration date, low detection rates, and the use of a content delivery network indicates a calculated effort to prolong operational status. Users are advised to treat any communication or links referencing 'Meritking Güncel İstasyonu' or similar lures as malicious. Organizations should update blocklists with the domain and IP address, while monitoring for credential leaks or unauthorized access attempts originating from this infrastructure.