guneydogusac[.]com[.]tr

This domain, guneydogusac.com.tr, is flagged for elevated risk due to credential theft activity targeting users through deceptive contact page impersonation. Analysis indicates the site was designed to harvest login credentials, financial details, or personal information under the guise of a legitimate communication portal, as evidenced by its page title 'Domain İletişim Sayfası' and confirmed malicious classifications by security vendors. Infrastructure analysis reveals the domain resolves to IP address 31.186.15.4, hosted under AS197720 (TURKTICARET.NET YAZILIM HIZMETLERI SAN. ve TIC. A.S.) in Turkey. The domain is secured with a Let's Encrypt SSL certificate (serial number E7), a common tactic to appear legitimate. VirusTotal detection rates show 19 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently offline. No specific brand impersonation was identified, but the generic contact page structure suggests broad targeting of Turkish-speaking users. Mitigation steps for organizations and users include immediate blocking of the domain and its resolving IP (31.186.15.4) at the network perimeter. Security teams should review logs for connections to this IP or domain to identify potential credential exposure. Users who interacted with the site should reset passwords for any accounts accessed during the exposure window and enable multi-factor authentication where available. Domain registrars and hosting providers should be notified of the malicious activity to prevent re-activation under similar names. Proactive monitoring for typosquatting variants (e.g., guneydogusac.com, guneydogus-ac.com) is recommended to detect follow-up campaigns.