oly[.]gkcinsaat[.]com

The domain oly.gkcinsaat.com was registered on 21 January 2021 through Global Domain Group LLC and is currently resolved to the IPv4 address 91.202.233.62. The address belongs to ASN 200593 (PROSPERO OOO) and is geolocated to Russia. Authoritative name servers are ns1.redav.net and ns2.redav.net. No TLS certificate is presented; the site responds without HTTPS, indicating an unencrypted HTTP service.

The only page title retrieved before the site was taken offline reads “163.5.171.74 25.11.2025 12:33:08”, which appears to be an IP address and timestamp rather than a recognizable brand or login prompt. VirusTotal reports that 12 of 95 scanned security vendors flagged the domain as malicious, and the domain appears on one external blocklist, where PhishDestroy has already listed it as a phishing host. The current offline status prevents real‑time content inspection, so the exact phishing vector (e.g., credential harvesting page) cannot be confirmed. Nevertheless, the combination of multiple vendor detections, blocklist inclusion, and the absence of a valid SSL certificate constitute strong evidence of malicious intent.

Defenders should add oly.gkcinsaat.com to DNS‑based blocklists, enforce HTTPS‑only policies for internal browsing, and monitor the hosting ASN for any new sub‑domains that might be activated. Continuous re‑resolution checks are advised in case the site is re‑hosted, and any outbound connections to 91.202.233.62 should be logged and investigated. Because the page title provides only an IP and timestamp, further forensic analysis of any captured network traffic is recommended to determine the exact phishing payload or credential collection mechanism.