bayram-promosyonu[.]duckdns[.]org

This domain, bayram-promosyonu.duckdns.org, is flagged for targeting users of online banking services, specifically mimicking the Garanti Bank website. The domain's primary intent is to deceive users into providing sensitive information such as login credentials, personal data, and financial details, which can be used for identity theft and unauthorized transactions.

Analysis indicates that 16 out of 95 security vendors on VirusTotal have flagged bayram-promosyonu.duckdns.org as malicious. The domain is registered through DuckDNS, a service known for providing free dynamic DNS, which often serves as a platform for temporary or low-cost phishing infrastructure. The domain was taken offline, and it appears on at least one security blocklist. Infrastructure analysis reveals the use of Plesk, PHP, Bootstrap, Cloudflare, and various content delivery networks (CDNs) including jQuery CDN and cdnjs, which are common in phishing sites to enhance the visual credibility of the fake web pages. The domain resolves to the IP address 83.142.209.40.

If users have visited bayram-promosyonu.duckdns.org, they should immediately check their online banking accounts for any unauthorized activity. It is recommended to change passwords for all related accounts and enable two-factor authentication (2FA) if not already in place. Users should also monitor their accounts for any unusual transactions and contact their bank's customer service to report the incident and seek further guidance on securing their accounts.