merlincrypto[.]com

Analysis of www.merlincrypto.com, created on 21 February 2026 and hosted on Cloudflare infrastructure (IP 188.114.97.3, AS13335, United States), shows a deliberate attempt to impersonate Crypto.com. The site presents the page title “Merlin - The Smartest Way to Track Your Crypto,” which aligns with the advertised crypto‑tracking service but does not reference the legitimate brand. The SSL certificate is issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake but offering no assurance of legitimacy. The domain is registered through IONOS SE and uses Cloudflare’s authoritative name servers (logan.ns.cloudflare.com, nina.ns.cloudflare.com). HTTP requests return a 200 status code, confirming the site is actively serving content.

Infrastructure analysis reveals the backend is built on Microsoft ASP.NET and incorporates common front‑end libraries such as Bootstrap, as well as third‑party services including Trustpilot, jsDelivr, Google Tag Manager, Google Analytics, and Facebook Pixel. Cloudflare Browser Insights is also present, suggesting the site leverages Cloudflare’s performance and security layer. The domain appears on a single security blocklist and has been flagged by PhishDestroy, while the Gridinsoft trust score is 0/100, reflecting a high likelihood of malicious intent. VirusTotal records show the domain was scanned by 93 vendors without any detections; however, the absence of detections does not constitute a safety guarantee.

The evidence collectively points to a brand‑impersonation scam targeting users of Crypto.com, likely intended to harvest credentials or induce financial transactions. Uncertainty remains regarding the exact payload or credential‑capture mechanism, as no page content has been disclosed. Defenders should block the domain at perimeter and DNS layers, monitor for outbound connections to the IP address, and add the domain to internal threat intelligence feeds.