merkl[.]sale

Analysis of merkl.sale shows a high‑risk, active phishing infrastructure targeting cryptocurrency users. The site’s page title – "Stable Airdrop Claim | Stable Airdrop Portal | Claim Stable Tokens | Merkl Airdrop Portal Access" – indicates a fraudulent airdrop claim vector. Intelligence flags the domain with five detections out of ninety‑three VirusTotal scanners, a Gridinsoft trust score of 0 / 100, and inclusion on a security blocklist. PhishDestroy has already blocked the domain, and the identified phishing kit is classified as an Airdrop Scam. Infrastructure details reveal the domain is hosted on Cloudflare, using the nameservers nicole.ns.cloudflare.com and cash.ns.cloudflare.com, and resolves to IP 188.114.97.3, located in the United States under AS13335 (Cloudflare, Inc.). The service presents a Google Trust Services / WE1 SSL certificate and supports HTTP/3, while HTTP requests return a 403 status, suggesting partial access restrictions but not preventing malicious activity. Registration records show the domain was created on 21 February 2026 via NiceNIC International Group Co., Limited. The combination of a cryptocurrency‑focused lure, low trust scores, multiple vendor detections, and active blocklist presence warrants a high‑risk rating. Defenders should immediately block merkl.sale at network perimeter and DNS layers, add the domain to threat‑intel feeds, and monitor for any derivative infrastructure that reuses the same Cloudflare IP range or similar airdrop‑related page titles. Continuous observation of the associated IP and nameserver changes is advised to detect potential repurposing.