Evidence verified October 26, 2026

Lookalike domains are impersonating Merkle

This is a public evidence page from Scam Detective’s published research. The real Merkle operates at merkle.com. The 1 domain below impersonates it — each with the corroborated evidence. Nothing here is a guess: every finding is backed by the independent sources listed further down the page.

1
Lookalike domains found
High
Overall risk level
3
Independent corroborating sources
October 26, 2026
Case verified
The evidence

Confirmed lookalike domains

High riskFake-recruiting lookalike — brand name on a subdomain of an unrelated parent

merkle.merscm.com

Registration profileA subdomain on the parent merscm.com — whose WHOIS record was updated September 22, 2026 behind a hidden registrant. Subdomains inherit no history of their own and can be created in seconds
First seenLive at verification (October 2026); corroborated by dentsu’s own job-fraud warning
Evidence
  • Live at verification and served through Cloudflare — an active recruiting lure, not a parked page.
  • Carries the Merkle name on a subdomain of merscm.com, a parent domain with no connection to the brand — the real Merkle (a dentsu company) operates at merkle.com and recruits from @merkle.com addresses.
  • The parent domain’s WHOIS record was updated September 22, 2026 with the registrant hidden — recent churn behind the operation, consistent with active subdomain management.
  • The campaign is corroborated by dentsu’s own published job-fraud warning page and its dedicated [email protected] reporting channel — the brand’s parent company has the impersonation on record.
  • Fake recruiting under a real agency’s name feeds the documented job-scam outcomes: advance fees, identity-theft harvests, or money muling.
Pattern watchlist — not yet independently confirmed

merkleclick.merscm.com — Rotating sibling lure subdomain on the same merscm.com parent — the operation swaps subdomain names (merkle → merkleclick) without ever registering a fresh domain, so a takedown of one name leaves the parent free to spin up the next.

The pattern

Red flags in this impersonation

  1. 01Wrong domain — the real agency is at merkle.com and recruits from @merkle.com addresses. “Merkle” branding served from merscm.com (or any other parent) is a lookalike by construction.
  2. 02Recruiting outreach that arrives through a domain you can’t trace to the employer — verify the sender domain against the company’s own site before replying, never via a link the outreach provides.
  3. 03Subdomain rotation on an unrelated parent — the operation keeps lure names (merkle, merkleclick) on one hidden-identity domain it controls, dodging the reputation cost of registering fresh names.
  4. 04Any recruiting process that leads to fees, equipment deposits, or identity/financial data collection before a real contract — that is the harvest, not onboarding.
  5. 05The brand’s own parent company publishing a job-fraud warning is itself a signal — dentsu maintains a [email protected] channel precisely because this campaign class is live.
Independent confirmation

Who corroborates this evidence

dentsu’s own job-fraud warning page

Dentsu (Merkle’s parent company) publishes a job-fraud warning page and a dedicated [email protected] reporting channel — the recruiting campaign impersonating its brands is independently on the record with the brand’s own organization.

Brand-domain mismatch

The real Merkle operates at merkle.com (a dentsu company) and recruits from @merkle.com addresses; merscm.com and its subdomains have no connection to the brand.

Fake-recruiting pattern match

Job-scam recruiting under a real company’s name matches the documented fake-recruiter playbook — the same pattern documented in the LEGO, Wordibly, Arctoris, KeenLogic, and Vosyn cases on this site.

Full investigative write-up: Fake Job Posting Scams in 2026: How to Spot a Phony Job Offer.

See exactly what you get

The audit, opened up

Findings · Risk ratings · Takedown template

Below is an abbreviated sample from a real audit format — the same report structure every $29 audit follows. The brand and domains shown are an illustrative example; your audit researches the company name and official domain you enter and documents what it finds the same way.

Sample — from a real audit format
Report date: March 14
Brand impersonation audit
Harborline Supply Co.
Official domain: harborlinesupply.com · 6 findings (5 shown) · 2 High · 2 Medium · 1 Low
Findings — lookalike domains
DomainTypeRiskEvidence
harborline-supply.comFake storefrontHighFull copy of the official site — same logo placement, layout, and product photography. Checkout collects card details before account creation. Registered 9 days ago behind a privacy proxy.
harborl1nesupply.comTyposquatHighDigit-for-letter swap ("1" for "l"). Redirect chain lands on a replica storefront with a cloned login form. SSL certificate issued 4 days after registration.
harborlinesupply-outlet.shopFake outletMediumPoses as a discount outlet channel. No affiliation disclosed anywhere on the site; the footer copies Harborline's legal text verbatim.
getharborlinesupply.comLookalikeMediumRoutes brand-name search traffic to a survey-with-prize flow before offering any products. Registered in the same bulk batch as the fake storefront above.
harborlinesupply.shopLookalikeLowBrand-name domain, currently parked with no active checkout. Rated Low and flagged for a re-check in 30 days in case it activates.

+ 1 more finding in the full report, documented the same way. Report summary: active impersonation campaign — act on the two High-risk domains first.

Takedown-request template — excerpt
Subject: Takedown request — <lookalike-domain> To the Abuse Team at <registrar / hosting provider>, I am writing on behalf of Harborline Supply Co., owner of the trademark HARBORLINE SUPPLY and the official website harborlinesupply.com. The domain <lookalike-domain>, registered through your service on <registration date>, impersonates our brand to deceive our customers: 1. Copies our logo, site layout, and product photography 2. Operates a checkout that collects visitors' card details 3. Discloses no affiliation with our company We request the immediate suspension of <lookalike-domain> …

The full template ships pre-filled with your brand, your official domain, and each finding's evidence — one per high-risk domain, ready to send to its registrar or host.

Your $29 audit follows this exact format for your company — every lookalike, typosquat, and copycat store found, each with its evidence and risk rating, plus the takedown template. Delivered instantly after checkout.

One-time payment

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29
Questions about this evidence, or need it for a takedown request? Email [email protected].
Not ready to buy?

Get the free Merkle impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.

Other brand evidence pages
Corkcicle →StoneX →Fidelity →Owala →BrüMate →MrBeast →USPS →LEGO →AMLBot →Amazon →Huawei →Daniel Wellington →SodaStream →CurrentBody →Dreame →Grubhub →TikTok Shop →Ooni →Simple Modern →Vessi →Swig Life →Barefoot Dreams →Midsummer Agency →Grow & Convert →Wordibly →Labrys →Arctoris →Staffology by IRIS →KeenLogic →Dotinum →Vosyn →OpenSea →THE OUTNET →Jelurida →Xeno →All evidence pages