mergec[.]mntbell[.]com

This domain is flagged as an active high-risk phishing infrastructure specifically designed to harvest user credentials by impersonating Rogers and Shaw telecommunication services. Analysis indicates the site presents a fraudulent login interface titled 'Sign in · Rogers together with Shaw,' mimicking the legitimate merger of these two Canadian telecom providers. The threat type is credential phishing, with a focus on exploiting trust in brand consolidation to deceive victims into submitting sensitive account details. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain mergec.mntbell.com was registered on March 02, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.67.168.150, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security vendors have flagged this domain at a rate of 24 out of 95 on VirusTotal, while Google Safe Browsing explicitly categorizes it as phishing. The site appears on one security blocklist, specifically PhishDestroy, and is secured with an SSL certificate issued by Google Trust Services (WE1). The creation date discrepancy—registered in 2026—suggests either a typographical error in registration data or an attempt to obfuscate tracking by manipulating domain age metadata. Mitigation steps for this threat include immediate blocking of the domain and its associated IP address (172.67.168.150) at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing mergec.mntbell.com and alert security teams to monitor for credential submission attempts originating from internal networks. End users should be educated to verify domain authenticity before entering login credentials, particularly for telecom-related services, and to report any suspicious login pages impersonating Rogers or Shaw. Security teams are advised to check logs for connections to 172.67.168.150 and review SSL certificate fingerprints associated with Google Trust Services WE1 for anomalous activity.