mercheofficialjob[.]com

This domain is flagged as an elevated-risk credential theft operation designed to impersonate legitimate recruitment portals. Analysis indicates the site targets individuals seeking employment by presenting fraudulent job listings and login interfaces to capture sensitive account credentials, including email addresses and passwords. Infrastructure analysis reveals the domain mercheofficialjob.com was registered on July 31, 2025, through Key-Systems GmbH, a registrar frequently associated with malicious domains. It resolves to IP address 172.67.200.108, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain currently lacks an SSL certificate, a common red flag for fraudulent sites. Detection metrics show 17 out of 95 security vendors on VirusTotal have flagged the domain as malicious. It appears on one security blocklist and is actively blocked by PhishDestroy, further confirming its malicious nature. The domain has since been taken offline, though historical DNS records may still pose residual risks. Mitigation steps for organizations and end users include immediately blocking the domain and its associated IP (172.67.200.108) at the network perimeter. Security teams should monitor for credential reuse attempts, particularly targeting corporate or personal email accounts. End users are advised to verify the legitimacy of job portals through official company channels before entering login credentials. Multi-factor authentication should be enabled on all critical accounts to mitigate the impact of credential theft. Given the domain's recent registration and lack of SSL, users should treat any unsolicited job offers from this domain as fraudulent.