merit-king[.]mobi

Analysis of the domain merit-king.mobi indicates it is an active phishing infrastructure targeting banking credentials. Registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to the IP address 188.114.97.3, which is geolocated to Canada and associated with Cloudflare, Inc. infrastructure. The domain's nameservers, woz.ns.cloudflare.com and chin.ns.cloudflare.com, further confirm its reliance on Cloudflare services. As of July 12, 2026, the domain is flagged by one security blocklist and appears in a single threat intelligence pulse on AlienVault OTX, with a Gridinsoft trust score of 0/100, reflecting high-risk classification. The domain presents an HTTP 403 status, suggesting access restrictions or a placeholder state, while the observed page title 'Just a moment...' is consistent with Cloudflare interstitial pages. Although only two of ninety-four security vendors on VirusTotal currently detect this domain, the presence of a Let's Encrypt SSL certificate (serial number E7) does not mitigate its malicious classification, as phishing sites frequently employ valid certificates to appear legitimate. The scam type is explicitly identified as banking phishing, though the specific financial institution being impersonated remains unconfirmed due to the absence of detailed page content analysis. Defenders should treat this domain as high-risk and consider implementing DNS or network-level blocks. The use of Cloudflare infrastructure complicates takedown efforts, as the registrar and hosting provider may require coordinated action. Continued monitoring is advised to track any shifts in hosting or domain status, particularly if the site transitions from its current restricted state to an active phishing page.