tr[.]meritkingguncelgir[.]vip

This domain is flagged for elevated-risk credential harvesting targeting users of the Meritking platform. Analysis indicates a phishing site mimicking the official Meritking login portal, designed to capture user credentials, payment details, or personal information through fraudulent input forms. The page title, "Meritking Giriş 2026 – Güncel & Resmi Meritking Adresi," explicitly claims to be an updated and official entry point, increasing the likelihood of deception for unsuspecting users seeking legitimate access. Infrastructure analysis reveals the domain tr.meritkingguncelgir.vip was registered on May 30, 2026, through Dynadot Inc, an uncommon registration timeline that may indicate an attempt to evade detection. It resolves to the IP address 104.21.21.210 and employs Cloudflare services, including Cloudflare Browser Insights and HTTP/3, to obfuscate hosting origins and enhance performance. The domain appears on one security blocklist, while VirusTotal reports 6 out of 95 security vendors flagging it as malicious. These indicators, combined with the use of a content delivery network, suggest an effort to prolong the campaign's lifespan and avoid takedowns. Mitigation steps for this threat type include immediate blocking of the domain and associated IP (104.21.21.210) at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing tr.meritkingguncelgir.vip and similar fraudulent domains. End-user education should emphasize verifying domain authenticity, particularly for login portals, and reporting suspicious URLs to internal security teams. Monitoring for credential leaks or unauthorized access attempts following exposure to this domain is recommended, as stolen data may be exploited in subsequent attacks.