vakifbankgirismobil[.]vercel[.]app

Analysis indicates that the domain vakifbankgirismobil.vercel.app was registered on 21 February 2026 through Tucows Domains Inc. and presently resolves to the IPv4 address 64.29.17.3, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting environment is identified as Vercel, and the presence of HTTP Strict Transport Security (HSTS) suggests that the service was configured to enforce secure connections. An SSL certificate issued by Google Trust Services under the WR1 label is active for the host, confirming the use of a legitimate certificate authority.

The site returned HTTP status code 451 and a page title of “Deployment Unavailable,” consistent with a deliberately taken‑offline state. Independent scanning on VirusTotal recorded 14 detections out of 95 security vendors, confirming malicious characteristics. The domain appears on at least one public blocklist and is actively blocked by the PhishDestroy service, reinforcing the assessment of a banking phishing threat.

Uncertainty remains regarding the specific content that was served before takedown, as no visual or functional analysis is available, and the exact phishing kit or credential‑harvesting mechanism has not been disclosed. Defenders should continue to block the IP address 64.29.17.3 and the domain itself at network perimeter devices, update URL filtering and threat‑intel feeds with the observed indicators, and monitor for any re‑hosting of the same payload on alternative Vercel deployments. Ongoing observation of the registrar and hosting ASN is advised to detect potential re‑registration attempts.