fahri-kayran[.]de

fahri-kayran.de was registered on 21 February 2026 through the registrar Living-bots and is hosted on an address in Germany (45.88.111.197, AS44486 synlinq.de). The authoritative nameservers are ns1.dnslinq.de and ns2.dnslinq.de. The site presents a TLS certificate issued by Let’s Encrypt (R13) and returns an HTTP 301 redirect. The page title returned by the server is “Fahri Kayran - Das bin ich!”. Automated analysis identified a stack that includes Plesk, Apache HTTP Server, Unpkg, OWL Carousel, jQuery and Font Awesome. The Gridinsoft trust score is 0 out of 100, indicating a lack of reputation.

VirusTotal has recorded five detections out of ninety‑three scanners, and the domain appears on one public phishing blocklist as well as the PhishDestroy blocklist. AlienVault OTX lists the domain in a single threat‑intel pulse. The risk level is classified as high and the threat type is generic phishing; the domain remains active as of the report date 24 July 2026. The available evidence confirms that the infrastructure is newly created, uses common web‑hosting components, and has already attracted modest detection from security vendors. However, the specific phishing payload, targeted victim set, and any credential‑harvesting pages have not been observed, leaving the exact attack vector uncertain. Defenders should prioritize immediate blocking of the domain and its resolved IP address at perimeter firewalls and proxy layers.

Adding the domain to internal URL filtering and threat‑intelligence feeds will ensure continued visibility. Continuous monitoring of the IP range owned by AS44486 and periodic re‑scans with VirusTotal or similar platforms are recommended to capture any escalation in malicious activity. Organizations that rely on the listed web technologies should be aware of potential abuse of these components for drive‑by or credential‑stealing scripts.