merkadistinction[.]com

The domain www.merkadistinction.com is currently flagged as an active generic phishing site. Registration records show the domain was created on 7 June 2021 through GoDaddy.com, LLC. DNS resolution points to the Cloudflare edge address 172.67.138.42 and the authoritative nameservers are brit.ns.cloudflare.com and dom.ns.cloudflare.com, indicating use of Cloudflare’s CDN infrastructure. The domain appears on a single public blocklist and is specifically blocked by the PhishDestroy filtering service, confirming that threat‑intelligence feeds have identified it as malicious.

VirusTotal has processed 91 antivirus engines for the domain and none have generated a detection; this lack of alerts does not constitute evidence of legitimacy and should be interpreted as insufficient coverage rather than safety. No public Safe Browsing, OTX, or other reputation services are listed in the available data, and no SSL certificate or HTTP status information has been disclosed. Analysts should treat the domain as a credential‑harvesting vector until further evidence is obtained.

Defensive recommendations include adding the domain and its resolving IP address to network deny lists, enforcing outbound traffic filtering for connections to the Cloudflare IP range, and monitoring DNS queries for the listed nameservers. Continuous re‑inspection of the domain through sandbox or URL‑reputation services is advised to capture any future payload changes. The current intelligence suggests that the infrastructure is intentionally obscured behind Cloudflare, a common tactic for phishing operators seeking resilience against takedown attempts.