merkrel[.]xyz

PhishDestroy identifies merkrel.xyz as a fraudulent domain actively impersonating Google to deploy a malicious cryptocurrency drainer. This site lures users with Google branding to trick victims into connecting cryptocurrency wallets, enabling unauthorized asset transfers upon interaction with deceptive interface elements. The domain's page title and branding mirror Google's official properties, creating a high-risk mimicry scenario designed to exploit user trust in well-known brands. The technical indicators supporting this assessment include a VirusTotal detection rate of 4 out of 95 antivirus engines as of the investigation timestamp, which indicates that current security definitions have not yet flagged the threat. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 24, 2026, and resolves to IP 172.67.130.72 using a Let's Encrypt SSL certificate. These attributes suggest an intentionally short-lived operation leveraging standard infrastructure to evade immediate detection while maintaining the appearance of legitimacy. Users who have visited merkrel.xyz should immediately cease any interaction with the site and disconnect any connected cryptocurrency wallets from suspicious interfaces. Conduct a thorough security scan on all devices used to access the domain and revoke any permissions granted to unknown or unauthorized applications. Report the domain to PhishDestroy for investigation and inclusion in global threat intelligence feeds to help protect the broader user community from this crypto drainer scam.