app[.]merkl[.]today

Analysis of the domain app.merkl.today, registered on February 27, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, indicates infrastructure associated with phishing activity targeting cryptocurrency users. The domain was taken offline by the time of this assessment on July 22, 2026, but prior telemetry shows it resolved to 104.21.57.60, a Cloudflare IP (AS13335) located in the US. Nameservers audrey.ns.cloudflare.com and rohin.ns.cloudflare.com confirm Cloudflare hosting, a common choice for both legitimate services and threat actors due to its proxy capabilities. No SSL certificate was detected, which is unusual for modern web services but not uncommon in low-effort phishing setups.

The domain appeared on one security blocklist, specifically PhishDestroy, though no additional public threat feeds or vendor detections were recorded at the time of analysis. The page title 'Just a moment...' aligns with Cloudflare's default challenge page, suggesting the site may have been behind Cloudflare's anti-bot protections or was in the process of being stood up. The absence of detections from VirusTotal's 93 scanned vendors does not confirm safety, as phishing domains often evade detection during early deployment or when targeting niche audiences. Defenders should treat this domain as suspicious based on its registration context, hosting pattern, and blocklist presence.

While the exact content and target brand remain unconfirmed, the use of 'merkl' in the subdomain suggests a potential focus on cryptocurrency or DeFi platforms, where 'merkle' or 'merkl' are common technical terms. Network defenders are advised to review logs for connections to 104.21.57.60 or the domain itself, particularly from endpoints handling financial or crypto-related transactions. If the domain reappears, further analysis of its HTTP responses, certificate transparency logs, and associated infrastructure is recommended to determine intent and potential brand impersonation.