toki-basvurum[.]xyz

This domain is flagged as an elevated-risk phishing infrastructure targeting Turkish Government services through brand impersonation. Analysis indicates the site specifically mimics the e-Devlet Kapısı portal, a critical authentication gateway for Turkish citizens accessing official services. The threat type centers on credential harvesting, likely designed to capture login credentials for subsequent unauthorized access to government systems or identity theft. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain toki-basvurum.xyz was registered on October 29, 2025, through Dynadot LLC, with no SSL certificate present. It resolves to IP address 78.159.156.57, hosted in the Netherlands under AS25211 (Euro Crypt EOOD). VirusTotal detection shows 17 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was previously blocked by PhishDestroy. The page title explicitly matches the legitimate e-Devlet Kapısı portal, reinforcing the impersonation attempt. Current status indicates the domain has been taken offline, though residual risk remains for any captured credentials. Mitigation requires immediate action from both users and network defenders. Organizations should implement DNS-based blocking for the domain and its resolving IP address 78.159.156.57, while monitoring for any credential reuse attempts. Users who may have interacted with the site should reset their e-Devlet credentials through official channels and enable multi-factor authentication where available. Government agencies should issue public advisories about this specific impersonation attempt, emphasizing the importance of verifying domain authenticity before entering credentials. Network defenders should review logs for connections to the IP address and domain during its active period.