getmerkl[.]app

Analysis of getmerkl.app shows a short‑lived infrastructure supporting a fake airdrop campaign that impersonates the Aave platform. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.144.170, located in the United States and announced by ASN 13335. Nameservers are arch.ns.cloudflare.com and tessa.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. No SSL certificate was observed, although the service advertised HSTS and HTTP/3 support, suggesting that TLS termination is performed by Cloudflare on behalf of the origin.

The site delivered a HubSpot‑based page whose title reads “Distribute Incentives | Merkl,” a phrasing that aligns with the declared scam type of a fake incentive distribution. Detection tooling has flagged the domain: seven of ninety‑three VirusTotal scanners reported malicious activity, Gridinsoft assigned a trust score of 0 / 100, and the domain appears on seven external blocklists. It has been actively blocked by PhishDestroy, MetaMask, ScamSniffer, Polkadot and SEAL, reinforcing the consensus that the host is malicious. The current operational status is offline, preventing immediate interaction, but the underlying registration and hosting details remain unchanged and could be re‑activated.

Defenders should add the domain and its resolving IP to deny‑list rules, monitor for re‑use of the same registrar or Cloudflare nameservers, and correlate any inbound traffic with the observed blocklist entries. Because the page content has not been captured, analysts should treat the “Distribute Incentives | Merkl” title as the only visible indicator of the campaign’s lure. Ongoing vigilance is recommended for any new sub‑domains or similar‑named sites that target Aave users with airdrop promises.