akgunoto[.]com[.]tr

This domain is classified as a high-risk fake login phishing site, designed to harvest user credentials through deceptive login portals. Analysis indicates the infrastructure is actively used for credential theft, with a focus on Turkish-speaking users given its .com.tr top-level domain and hosting location. Infrastructure analysis reveals the domain akgunoto.com.tr resolves to the IP address 83.150.212.253, geolocated in Turkey and associated with VoyarTechnologies. It was registered on April 10, 2012, through the registrar Internetbilisim, suggesting a long-standing but repurposed domain for malicious activity. Detection metrics show 20 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing explicitly labels it as phishing. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to lend superficial legitimacy to phishing sites. To mitigate risks associated with this fake login phishing domain, users should avoid entering any credentials or personal information on the site. Organizations should update web filters to block the domain and its associated IP address (83.150.212.253). Security teams are advised to monitor for signs of credential compromise among users who may have interacted with the domain prior to its takedown. If credentials were entered, immediate password resets and multi-factor authentication enforcement are recommended for all affected accounts.