tr[.]meritking-guncel[.]top

Analysis of tr.meritking-guncel.top indicates that the domain was registered on June 22 2026 through Dynadot LLC and is currently resolved to the IPv4 address 130.12.180.244, which belongs to AS202412 Omegatech LTD located in Germany. The authoritative name servers are jakub.ns.cloudflare.com and priscilla.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The site presented an SSL certificate issued by Let’s Encrypt (common name YE1), confirming that TLS was enabled at the time of observation. VirusTotal scans show that four of ninety‑one security vendors flagged the domain, and the domain is listed on at least one public blocklist.

PhishDestroy has actively blocked the host, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence in malicious intent. The page title returned by the web server is identical to the domain name, offering no additional context about the targeted brand or service. The domain’s current status is offline, suggesting that the malicious infrastructure has been taken down or is being cycled.

Defenders should continue to monitor the associated IP address and related ASN for any resurgence, add the domain and IP to internal blocklists, and enforce network‑level filtering of traffic to the certificate’s issuing authority if appropriate. Because the site’s content has not been captured, the exact phishing payload or credential‑harvesting technique remains unknown; investigators should seek archived captures or request forensic snapshots if further attribution is required. The combination of recent registration, low trust score, multiple vendor detections, and blocklist presence classifies the domain as an elevated‑risk indicator warranting proactive mitigation.