mercadopagol[.]xyz

Analysis indicates that mercadopagol.xyz is an active phishing domain registered on July 18, 2026, through Dynadot Inc. Infrastructure reveals Cloudflare nameservers (indie.ns.cloudflare.com and rajeev.ns.cloudflare.com) and resolution to IP address 104.21.27.56. As of July 19, 2026, the domain appears on one security blocklist and is flagged by one of 91 security vendors on VirusTotal, suggesting detection of malicious activity. The domain name closely resembles Mercado Pago, a widely used online payment platform, though the exact content of the site has not yet been analyzed to confirm impersonation or specific attack vectors. Defenders should note that the domain remains active and may be leveraged in credential harvesting or fraudulent payment redirection schemes. The use of Cloudflare infrastructure is consistent with threat actors attempting to obscure hosting origins and evade takedowns. While only a single vendor detection exists at this time, the rapid registration-to-deployment timeline (under 24 hours) aligns with common phishing campaign patterns. Organizations are advised to block the domain at the DNS or proxy level and monitor for related indicators of compromise, including the associated IP address. Further investigation into user interactions with this domain is recommended to assess potential exposure.