# PhishDestroy domain threat record: edevlet.vatandasgiris.org

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/edevlet.vatandasgiris.org/
Machine-readable companion: https://phishdestroy.io/domain/edevlet.vatandasgiris.org/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 13:18:29 UTC
- Last availability or vendor check: 2026-10-23 10:00:28 UTC
- Stored record updated: 2026-10-23 18:21:16 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: govtr

## Stored infrastructure

- Observed IP address: 185.146.22.243
- Registrar in stored WHOIS data: Webcentral Group Ltd
- Registrar country in stored WHOIS data: TR
- Registration date (registry RDAP, vatandasgiris.org): 2026-10-20 16:46:17 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a163c2-2eba-75cd-bfed-2e529a48601a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/edevlet.vatandasgiris.org
- Certificate Transparency search: https://crt.sh/?q=%25.edevlet.vatandasgiris.org
- Web Archive lookup: https://web.archive.org/web/*/https://edevlet.vatandasgiris.org/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed edevlet.vatandasgiris.org after Google Safe Browsing flagged it for social‑engineering on 2026-10-22. The recorded page title was “e-Devlet Kapısı”, suggesting an impersonation of the Turkish government portal. An HTTP 200 response was recorded for the domain on the same date. The listing does not prove current activity.

How the scam works
Websites that mimic official government services often present login‑style pages to collect usernames, passwords, or national ID numbers. Victims who enter credentials may have them reused on the real portal, leading to account compromise. This is a typical credential‑phishing pattern for social‑engineering sites, though no specific form was observed on this page.

Evidence
Google Safe Browsing marked the domain as a social‑engineering threat on 2026-10-22. VirusTotal reported 2 malicious detections out of 92 engines on the same date, with alphaMountain.ai labeling it as phishing and CRDF as malicious. urlscan.io scanned the site on 2026-10-22 and returned a malicious verdict, categorising it as phishing and associating it with the Turkish Government brand. OpenPhish also lists the domain, while Spamhaus DBL showed no entry and OTX reported zero pulses as of the check date.

Infrastructure
The recorded IP was 185.146.22.243, associated with WHG Hosting Services Ltd in Germany. The TLS certificate, issued by Let’s Encrypt, covered *.vatandasgiris.org and was valid until 2027-01-19. Authoritative nameservers were ns1‑ns4.a2hosting.com. The server header indicated LiteSpeed, and ports 21, 22, 25, 80, 110, 143, 443, 587, 993, 995 were observed as open during the scan.

What to do
Visitors should avoid entering any credentials on the site; if they have already done so, they should change passwords on the official e‑Devlet portal and monitor for unauthorized activity. Organizations should add the exact domain to URL‑filtering or web‑proxy block lists and review access logs for connections to the recorded IP address, applying standard incident‑response procedures if suspicious traffic is found.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a163c2-2eba-75cd-bfed-2e529a48601a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/0467ada4-0b7d-4997-ae02-52253dd492d0
URLQuery report: https://urlquery.net/report/0cc87228-8b13-4168-8702-268cd493494d
Stored capture screenshot: https://i.ibb.co/23sHjPL4/1463b8b5f0fe.png
Cloudflare Radar screenshot (2026-10-22T13:56:51Z): https://screenshots.phishdestroy.io/cf/0467ada4-0b7d-4997-ae02-52253dd492d0.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/0cc87228-8b13-4168-8702-268cd493494d.png
URLScan screenshot (2026-10-21T19:26:30Z): https://screenshots.phishdestroy.io/us/01a15fed-cf90-7574-b4ed-f6c46f565c93.png
URLScan capture report: https://urlscan.io/result/01a15fed-cf90-7574-b4ed-f6c46f565c93/
URLScan screenshot (2026-10-22T13:05:48Z): https://screenshots.phishdestroy.io/us/01a163b7-a137-77bd-b904-48b981a52830.png
URLScan capture report: https://urlscan.io/result/01a163b7-a137-77bd-b904-48b981a52830/
URLScan screenshot (2026-10-22T13:39:28Z): https://screenshots.phishdestroy.io/us/01a163d6-6a68-721d-89d0-b0c2d3e3adbd.png
URLScan capture report: https://urlscan.io/result/01a163d6-6a68-721d-89d0-b0c2d3e3adbd/
VirusTotal report: https://www.virustotal.com/gui/domain/edevlet.vatandasgiris.org
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=edevlet.vatandasgiris.org
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 16:29:46 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/23sHjPL4/1463b8b5f0fe.png
  Captured: 2026-10-22 13:18:29 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a163c2-2eba-75cd-bfed-2e529a48601a.png
  Captured: 2026-10-22 13:18:29 UTC
  Source report: https://urlscan.io/result/01a163c2-2eba-75cd-bfed-2e529a48601a/
- URLScan capture 2: https://urlscan.io/screenshots/01a163b7-a137-77bd-b904-48b981a52830.png
  Captured: 2026-10-22 13:10:40 UTC
  Source report: https://urlscan.io/result/01a163c2-2eba-75cd-bfed-2e529a48601a/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0467ada4-0b7d-4997-ae02-52253dd492d0.png
  Captured: 2026-10-22 13:56:51 UTC
  Source report: https://radar.cloudflare.com/scan/0467ada4-0b7d-4997-ae02-52253dd492d0
  SHA-256: 6571281e99e4332f917e9d1dca9b6551839cec156f925a2f6d89da2bf664f524
- URLQuery: https://screenshots.phishdestroy.io/uq/0cc87228-8b13-4168-8702-268cd493494d.png
  Source report: https://urlquery.net/report/0cc87228-8b13-4168-8702-268cd493494d
  SHA-256: a3bea8c10bf2a4ea7a26d8089ba627999b343806afae0d903a7acfa836b72b26
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15fed-cf90-7574-b4ed-f6c46f565c93.png
  Captured: 2026-10-21 19:26:30 UTC
  Source report: https://urlscan.io/result/01a15fed-cf90-7574-b4ed-f6c46f565c93/
  SHA-256: ff97cce2d30c36bf07ef3aca6707a79a36384e25db52e4ed6ca8141476fe7bef
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163b7-a137-77bd-b904-48b981a52830.png
  Captured: 2026-10-22 13:05:48 UTC
  Source report: https://urlscan.io/result/01a163b7-a137-77bd-b904-48b981a52830/
  SHA-256: ff97cce2d30c36bf07ef3aca6707a79a36384e25db52e4ed6ca8141476fe7bef
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163d6-6a68-721d-89d0-b0c2d3e3adbd.png
  Captured: 2026-10-22 13:39:28 UTC
  Source report: https://urlscan.io/result/01a163d6-6a68-721d-89d0-b0c2d3e3adbd/
  SHA-256: 7112f3b3fbd30565c26091cc351c5fa9fb60a27bfbc686972e371782e57bcf01

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T13:59:48Z",
        "uuid": "01a163c2-2eba-75cd-bfed-2e529a48601a",
        "scanned_at": "2026-10-22T13:17:20Z",
        "final_url": "https://edevlet.vatandasgiris.org/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://edevlet.vatandasgiris.org/",
                "from": "http://edevlet.vatandasgiris.org/",
                "status": 307
            }
        ],
        "ip": "185.146.22.243",
        "ptr": "nl1-ts109.a2hosting.com",
        "ips": [
            "185.146.22.243"
        ],
        "asns": [
            "209341"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "f263b200eb111008ee590fe0eb9790c22a9526376a372361c0bb5dce9ea83007",
        "script_hashes": [
            "3bacfc35f557cd0e1123ae0ab6eb1938efbf3f07d12826a5cc95eac17e3bcf9e",
            "af0f85520a90e7a0d02a262e2b9239e57136339b74bb6a29ed817481c5a554d8",
            "08644ef2726933a7a293cb7bdea2236f57c1f6e1502d2433f62d6b79a630aa5c"
        ],
        "globals": [
            "staticServer",
            "overrideVueAddress",
            "_typeof",
            "_slicedToArray",
            "_nonIterableRest",
            "_unsupportedIterableToArray",
            "_arrayLikeToArray",
            "_iterableToArrayLimit",
            "_arrayWithHoles",
            "is",
            "edRun",
            "paths",
            "eds",
            "ess",
            "edkLoaderParams",
            "edWebLoaderParams",
            "edl",
            "edCom",
            "edEvent",
            "edkRC",
            "open_accessibility_menu",
            "close_accessibility_menu",
            "is_accessibility_menu_open",
            "toggle_accessibility_menu",
            "open_user_menu",
            "close_user_menu",
            "is_user_menu_open",
            "toggle_user_menu",
            "ownKeys",
            "_objectSpread",
            "_defineProperty",
            "_toPropertyKey",
            "_toPrimitive",
            "uts",
            "e11k",
            "commonJsLoaded",
            "uan",
            "$",
            "jQuery",
            "getJs"
        ],
        "tls": {
            "san": [
                "*.vatandasgiris.org",
                "www.edevlet.vatandasgiris.org"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "*.vatandasgiris.org",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T13:37:56Z",
            "valid_from": "2026-10-21T13:37:57Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 1,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 20,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "govtr"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Turkish Government"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html",
            "strict-transport-security": "max-age=63072000; includeSubDomains",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T13:59:50Z",
        "uuid": "0467ada4-0b7d-4997-ae02-52253dd492d0",
        "scanned_at": "2026-10-22T13:56:51Z",
        "final_url": "https://edevlet.vatandasgiris.org/",
        "status": 200,
        "history": [
            {
                "url": "https://edevlet.vatandasgiris.org/",
                "status": 200
            }
        ],
        "dom_hash": "d3b0c18fe3cb93650a6b55841b27f9b650d6678c40d65ec8784e8b2525172331",
        "doc_hash": "7d0ec014eaddbaea428f76a3b82b17422cf19036423f75776b3f4d1ff09720b6",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "edevlet.vatandasgiris.org",
                "type": "A",
                "value": "185.146.22.243"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.146.22.243",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Netregistry Wholesale Pty Ltd",
            "created": "2026-10-20T16:46:17Z",
            "expires": "2027-10-20T16:46:17Z",
            "nameservers": [
                "ns1.mysecurecloudhost.com",
                "ns2.mysecurecloudhost.com",
                "ns3.mysecurecloudhost.com",
                "ns4.mysecurecloudhost.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T16:28:37Z",
        "analysis_at": "2026-10-21T23:59:04Z",
        "stats": {
            "timeout": 0,
            "harmless": 0,
            "malicious": 2,
            "suspicious": 0,
            "undetected": 90
        },
        "detections": {
            "CRDF": "malicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Google": "government",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Netregistry Wholesale Pty Ltd",
        "created": "2026-10-20T16:46:17Z",
        "expires": "2027-10-20T16:46:17Z",
        "updated": "2026-10-20T16:46:18Z",
        "first_seen": "2026-10-21T14:41:48Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:185.146.22.243 include:spf.a2hosting.com ~all"
            },
            {
                "ttl": 5462,
                "type": "A",
                "value": "185.146.22.243"
            }
        ],
        "dns_at": "2026-10-22T00:30:09Z",
        "jarm": "2ad2ad0002ad2ad00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.vatandasgiris.org",
                "www.edevlet.vatandasgiris.org"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "54c8820d63122e982e42ecfddbbac2f130e",
            "sha256": "a930eca4321436dc2d95f4a57173fe8bcdf82a84caaa13e339f27fd06dec243e",
            "subject": "*.vatandasgiris.org",
            "valid_to": "2027-01-19T13:37:56Z",
            "valid_from": "2026-10-21T13:37:57Z"
        },
        "whois": {
            "registrar": "Netregistry Wholesale Pty Ltd",
            "registrar_iana_id": "13",
            "registrar_url": "hrs-admin.webcentralgroup.com.au",
            "created": "2026-10-20T16:46:17Z",
            "updated": "2026-10-20T16:46:17Z",
            "expires": "2027-10-20T16:46:17Z",
            "status": [
                "addPeriod"
            ],
            "nameservers": [
                "ns1.mysecurecloudhost.com",
                "ns2.mysecurecloudhost.com",
                "ns3.mysecurecloudhost.com",
                "ns4.mysecurecloudhost.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:56:54Z",
        "mail_config": {
            "spf": "v=spf1 +a +mx +ip4:185.146.22.243 include:spf.a2hosting.com ~all",
            "dkim": [
                "default"
            ],
            "dmarc": true,
            "dkim_bits": 2048,
            "spf_lookups": 4
        },
        "caa_records": {
            "domain": "edevlet.vatandasgiris.org"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-22T13:15:35Z",
            "first": "2026-10-22T13:15:35Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 5729
        },
        "social_tags": {
            "ogUrl": "https://edevlet.vatandasgiris.org",
            "title": "e-Devlet Kapısı",
            "ogType": "website",
            "robots": "index,follow",
            "ogImage": "https://edevlet.vatandasgiris.org/image/vatandas.jpg",
            "ogTitle": "e-Devlet Kapısı Devletin Kısayolu| www.edevlet.vatandasgiris.org",
            "themeColor": "#4284be",
            "ogDescription": "e-Devlet Kapısı'nı kullanarak kamu kurumlarının sunduğu hizmetlere tek noktadan, hızlı ve güvenli bir şekilde erişim sağlanırken geliştirilen mobil uygulama ile hizmetlere erişim her yerden mümkün hale gelmiştir."
        },
        "trackers": {
            "requests": 19
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 37,
                "wait": 18,
                "connect": 26,
                "download": 17
            },
            "response_ms": 100
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                21,
                22,
                25,
                80,
                110,
                143,
                443,
                587,
                993,
                995
            ]
        },
        "carbon": {
            "bytes": 16747,
            "co2_grams": 0.0006,
            "cleaner_than": 61
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "99.83.147.209",
                    "host": "ns4.a2hosting.com"
                },
                {
                    "ip": "76.223.26.245",
                    "host": "ns3.a2hosting.com"
                },
                {
                    "ip": "75.2.118.134",
                    "host": "ns2.a2hosting.com"
                },
                {
                    "ip": "13.248.158.180",
                    "host": "ns1.a2hosting.com"
                }
            ],
            "zone": "vatandasgiris.org"
        },
        "location": {
            "ip": "185.146.22.243",
            "asn": "209341",
            "org": "WHG Hosting Services Ltd",
            "city": "Frankfurt am Main",
            "country": "DE"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "*.vatandasgiris.org"
        },
        "dns": {
            "A": [
                "185.146.22.243"
            ],
            "TXT": [
                "v=spf1 +a +mx +ip4:185.146.22.243 include:spf.a2hosting.com ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains",
            "message": "HSTS header does not contain the preload directive."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=63072000; includeSubDomains",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.146.22.243",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://edevlet.vatandasgiris.org"
            ]
        },
        "tech_stack": {
            "technologies": [
                "LiteSpeed",
                "jQuery",
                "crypto-js",
                "HSTS",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 4
        },
        "whois": {
            "registrar": "Netregistry Wholesale Pty Ltd",
            "created": "2026-10-20T16:46:17Z",
            "updated": "2026-10-20T16:46:17Z",
            "expires": "2027-10-20T16:46:17Z",
            "status": [
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.mysecurecloudhost.com",
                "ns2.mysecurecloudhost.com",
                "ns3.mysecurecloudhost.com",
                "ns4.mysecurecloudhost.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "LiteSpeed",
                "content-type": "text/html",
                "strict-transport-security": "max-age=63072000; includeSubDomains",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff"
            }
        }
    }
}
```