guncel-mertking[.]com

Analysis of guncel-mertking.com indicates an active high‑risk banking phishing campaign. The domain was registered on April 11, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 188.114.96.3, which is geolocated to Canada and belongs to a cloud hosting network. DNS resolution uses the authoritative nameservers armfazh.ns.cloudflare.com and stephane.ns.cloudflare.com. The site presents an HTTP 403 response and serves a TLS certificate issued by a free certificate authority, indicating encrypted traffic without revealing the underlying content. Threat intelligence sources have recorded a single pulse referencing this domain, and it appears on at least one security blocklist. Independent scanning engines have flagged the domain in two out of ninety‑four analyses, suggesting malicious behavior. While the page title "Just a moment..." provides limited insight into the phishing payload, the classification as banking phishing aligns with the observed infrastructure. Defenders should block network traffic to the IP 188.114.96.3, add the domain to URL filtering policies, and monitor for related indicators such as the specific nameserver strings. Continuous observation is advised to detect any evolution of the campaign or additional payload delivery.