stable[.]merkl[.]app

This domain stable.merkl.app is classified as generic_phishing with a high risk level and remains active as of July 12 2026. Infrastructure analysis reveals registration through Cloudflare Inc. with resolution to the IPv6 address 2606:4700:3033::ac43:ac26 located in the US under AS13335. The domain uses Cloudflare and HTTP/3 technologies along with an SSL certificate issued by Google Trust Services under WE1. HTTP status returns 301 while the observed page title is merkl.app | 522: Connection timed out. VirusTotal reports detection by 7 out of 95 security vendors and the domain appears on 2 security blocklists with a Gridinsoft trust score of 0/100. It is already blocked by PhishDestroy and ScamSniffer.

Analysis indicates the domain continues to serve content despite the 522 error code recorded in the page title. The combination of Cloudflare hosting an IPv6 endpoint and a low trust score confirms active infrastructure that matches patterns seen in generic_phishing operations. Exact page content beyond the recorded title has not yet been analysed so the precise redirection target after the 301 response remains uncertain. No registration date or creation timestamp is provided in the available data.

Defenders should add the IPv6 address 2606:4700:3033::ac43:ac26 and the domain stable.merkl.app to network block lists immediately. Monitoring for any new resolutions or certificate renewals from Google Trust Services is recommended because the current status is still active. Regular checks against the two existing blocklists and the 7 detections on VirusTotal will help track changes in malicious indicators over time.