Is officialmercator.shop safe?
http://officialmercator.shop/
Coveragestrong3 of 4 applicable core capabilities
officialmercator.shop is flagged as phishing by five antivirus families and hides its operator behind an email that belongs to another company's domain.
officialmercator.shop presents itself as an online shop for air and lighting products, complete with product navigation, a cart and 'Shop Now' and 'Shop Collection Now' buttons. Despite that polished storefront, a saved antivirus observation shows five independent antivirus families flagging the domain as malicious or phishing — a serious finding for a site whose only function is to collect orders and payment details ('source:antivirus:aggregate'). The storefront also gives visitors no way to verify who is behind it: the only contact address uses the unrelated domain mercator.com, and the captured page shows no phone number and no postal address ('observed:page-content:issue:1', 'observed:page-content:issue:2', 'observed:page-content:issue:3'). The browser threat feed currently returns no warning and the TLS connection is encrypted, but encryption only hides traffic — it does not make the seller honest ('observed:safe-browsing', 'observed:tls'). Taken together, the phishing detections and the missing operator details put this in the High Risk band.
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
01 · Investigation Brief
Investigation Brief
officialmercator.shop presents itself as an online shop for air and lighting products, complete with product navigation, a cart and 'Shop Now' and 'Shop Collection Now' buttons. Despite that polished storefront, a saved antivirus observation shows five independent antivirus families flagging the domain as malicious or phishing — a serious finding for a site whose only function is to collect orders and payment details ('source:antivirus:aggregate'). The storefront also gives visitors no way to verify who is behind it: the only contact address uses the unrelated domain mercator.com, and the captured page shows no phone number and no postal address ('observed:page-content:issue:1', 'observed:page-content:issue:2', 'observed:page-content:issue:3'). The browser threat feed currently returns no warning and the TLS connection is encrypted, but encryption only hides traffic — it does not make the seller honest ('observed:safe-browsing', 'observed:tls'). Taken together, the phishing detections and the missing operator details put this in the High Risk band.
Security flags and a hidden operator
A saved antivirus observation records that five independent antivirus families returned an adverse result for this domain, with BitDefender, CRDF and CyRadar named among them ('source:antivirus:aggregate'). That kind of agreement across separate vendors is not a false-positive footnote; it usually means the site has been tied to phishing or another credential-stealing pattern. The observation is stale and partial, so it should be confirmed against a current scan before any purchase, but it carries real weight against an unknown store.
Separately, the site's own pages fail the most basic transparency test. The only captured contact email uses mercator.com, a domain that does not match officialmercator.shop, and the captured page lists no phone number and no operator postal address ('observed:page-content:issue:1', 'observed:page-content:issue:2', 'observed:page-content:issue:3'). A shop that wants card details but hides its legal identity and routes contact to another company's domain gives a buyer no way to raise a complaint or seek a refund.
Two technical checks are clean: the browser threat feed returned no warning and the saved TLS check found a valid encrypted connection ('observed:safe-browsing', 'observed:tls'). Neither addresses operator honesty — a padlock is just encryption, and Safe Browsing reflects a point-in-time list, not a full audit of who runs the shop or whether orders are fulfilled.
A product storefront mixed with another brand's imagery
The captured navigation and calls to action read like a normal e-commerce store: a 'Shop' menu entry, a 'Cart', a 'Shop Now' button and a 'Shop Collection Now' button all point to transactions handled on the same domain ('observed:page-block:document:primary:block:2', 'observed:page-block:document:primary:block:3', 'observed:page-block:document:primary:block:8', 'observed:page-block:document:primary:block:50'). That is a commercial funnel with a checkout, which is exactly why the phishing flags and the missing operator identity matter.
The hero image on the page shows a mobile app interface labeled 'MERCATOR ikuu', which is consistent with the site borrowing a real brand's look rather than operating as an independent, clearly identified merchant ('derived:vision-observation:1'). Combined with the contact email on the unrelated mercator.com domain, the branding and the contact trail do not fit a self-standing shop with a verifiable identity ('observed:page-content:issue:1', 'derived:vision-observation:1').
Why the score is 28
5 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
9/ 93
detectionsSaved analysis from October 11, 2026 - stale
9 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 6
- Suspicious
- 3
- Total
- 93
| Engine | Finding |
|---|---|
| BitDefenderMalicious | phishing |
| CRDFMalicious | malicious |
| CyRadarMalicious | phishing |
| G-DataMalicious | phishing |
| LevelBlueMalicious | phishing |
| WebrootMalicious | malicious |
| alphaMountain.aiSuspicious | spam |
| ESETSuspicious | suspicious |
| GridinsoftSuspicious | suspicious |
All 93 engine results
- BitDefender - phishing - Malicious
- CRDF - Malicious
- CyRadar - phishing - Malicious
- G-Data - phishing - Malicious
- LevelBlue - phishing - Malicious
- Webroot - Malicious
- alphaMountain.ai - spam - Suspicious
- ESET - Suspicious
- Gridinsoft - Suspicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Unrated
- Fortinet - Clean
- Fortra - Unrated
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- Orcapot - Unrated
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
The hero image shows a mobile app interface labeled 'MERCATOR ikuu', suggesting the site may be attempting to impersonate a legitimate smart home brand.
What the captured page showed
1 observation- 01
The hero image shows a mobile app interface labeled 'MERCATOR ikuu', suggesting the site may be attempting to impersonate a legitimate smart home brand.
03 · Investigation Story
Investigation story
What the site claims
Ceiling Fans & Smart Lighting | Mercator
What we observed
The page content was captured and checked alongside 59 antivirus results.
What independent research found
The search completed without a material external warning or corroborating report.
What remains unverified
1 of the 4 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Fake Shop & Commercial Deception
Service and business model
Shop
Observed behavior
Evidence behind this classification
- 015 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
- 02No contact email on the captured page uses the site's own domain; the only address routes to mercator.com, which belongs to a different company ('observed:page-content:issue:1').
- 03The captured page lists no phone number and no operator postal address, leaving visitors no verifiable way to reach the seller ('observed:page-content:issue:2', 'observed:page-content:issue:3').
Web research findings
Independent findings for officialmercator.shop, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
No independently sourced scam reports or credibility records were found for officialmercator.shop. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domainofficialmercator.shop
- Redirects toofficialmercator.shop
- Hosted byBeijing Ruihao Kai Yuan Technology Co., Ltd
- Referencesfonts.googleapis.com · fonts.gstatic.com
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- No contact email uses the site's own domain.
- No phone number listed on the captured page.
- No operator postal address visible on the captured page.
Domain & Encryption
Redirect Chain
- 1301http://officialmercator.shop/
- 2200https://officialmercator.shop/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
5 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
The captured page presents a standard e-commerce funnel with 'Shop', 'Cart', 'Shop Now' and 'Shop Collection Now' elements pointing to same-site transactions ('observed:page-block:document:primary:block:2', 'observed:page-block:document:primary:block:3', 'observed:page-block:document:primary:block:8', 'observed:page-block:document:primary:block:50'). · No contact email on the captured page uses the site's own domain; the only address routes to mercator.com, which belongs to a different company ('observed:page-content:issue:1').
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 9 of 93 engines flagged | Limited | Adverse | stale fallback · analysed Oct 11, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 17, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Oct 17, 2026 |
| Visual evidence | 1 visible observation saved with the page capture | Completed | No adverse finding | this scan · Oct 17, 2026 |
| Independent research | The search completed without a material external finding | Completed | No adverse finding | this scan · Oct 17, 2026 |
- Antivirus
- Result9 of 93 engines flagged
- CompletionLimited
- FindingAdverse
- Freshnessstale fallback · analysed Oct 11, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 17, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 17, 2026
- Visual evidence
- Result1 visible observation saved with the page capture
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 17, 2026
- Independent research
- ResultThe search completed without a material external finding
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 17, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is officialmercator.shop a scam or a legit online store?
Is officialmercator.shop safe to use?
What should I do if I already gave my details to officialmercator.shop?
Can I get my money back from officialmercator.shop?
I ordered from officialmercator.shop but nothing arrived — is it a fake shop?
How do I report officialmercator.shop?
Why does officialmercator.shop look legitimate if it's a scam?
Has officialmercator.shop been flagged by antivirus engines?
Is officialmercator.shop on any phishing or malware blacklists?
Does officialmercator.shop have a valid SSL certificate?
Where is officialmercator.shop hosted?
How often is the officialmercator.shop report updated?
08 · Final Verdict
Final verdict
officialmercator.shop is flagged as phishing by five antivirus families and hides its operator behind an email that belongs to another company's domain.
officialmercator.shop presents itself as an online shop for air and lighting products, complete with product navigation, a cart and 'Shop Now' and 'Shop Collection Now' buttons. Despite that polished storefront, a saved antivirus observation shows five independent antivirus families flagging the domain as malicious or phishing — a serious finding for a site whose only function is to collect orders and payment details ('source:antivirus:aggregate'). The storefront also gives visitors no way to verify who is behind it: the only contact address uses the unrelated domain mercator.com, and the captured page shows no phone number and no postal address ('observed:page-content:issue:1', 'observed:page-content:issue:2', 'observed:page-content:issue:3'). The browser threat feed currently returns no warning and the TLS connection is encrypted, but encryption only hides traffic — it does not make the seller honest ('observed:safe-browsing', 'observed:tls'). Taken together, the phishing detections and the missing operator details put this in the High Risk band.
09 · Community