Analysis of the domain tr.mertking-online22.net confirms its classification as an active phishing site, registered on July 27, 2026, through Cloudflare, Inc. Infrastructure analysis reveals the domain resolves to the IP address 130.12.180.241 and is currently operational, with no indications of takedown or deactivation. The domain is hosted on Cloudflare nameservers (ainsley.ns.cloudflare.com and guy.ns.cloudflare.com), a common tactic to obscure hosting origins and evade immediate detection. As of July 29, 2026, the domain appears on one security blocklist, specifically PhishDestroy, and is flagged by one of 91 security vendors on VirusTotal, suggesting early but growing detection.
The specific phishing campaign or targeted brand remains unconfirmed, as no page title, brand target, or scam type has been provided in available intelligence. The domain name itself does not conclusively indicate a specific brand or service being impersonated, and no login forms, tracking pages, or visual content have been analyzed. Defenders should note that the domain's recent registration and use of Cloudflare infrastructure align with common phishing tactics designed to exploit short-lived domains for rapid deployment and evasion.
Organizations are advised to block access to tr.mertking-online22.net at the DNS or proxy level and monitor for connections to the associated IP address 130.12.180.241. Security teams should also review logs for any user interactions with the domain, particularly within 48 hours of its registration, as this period often corresponds with peak phishing activity. Given the domain's presence on a single blocklist and minimal vendor detection, further monitoring of threat intelligence feeds is recommended to track additional indicators of compromise or campaign expansion.