eurostaryurtdisiegitim[.]net

Analysis of the domain eurostaryurtdisiegitim.net indicates it is actively involved in a phishing campaign targeting individuals seeking overseas education consulting services. The domain was registered on February 21, 2026, through Nics Telekomunikasyon A.S., a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 217.195.196.7, hosted on AS20649 (FS Veri Merkezi Internet Teknolojileri Limited Sirketi) in Turkey. Nameservers ns7.webimhosting.com and ns8.webimhosting.com are utilized, both of which have been previously linked to other malicious or suspicious domains. The site presents itself as a legitimate education consultancy under the title 'Yurtdışı Eğitim Danışmanlığı | Yurtdışında Eğitim - İyiki Eurostar,' suggesting it targets Turkish-speaking users. Technology stack analysis identifies the use of WordPress, MySQL, PHP, Bootstrap, Apache HTTP Server, Yandex.Metrika, prettyPhoto, and OWL Carousel, which are common in both legitimate and fraudulent websites. The domain currently returns an HTTP 301 redirect, though the destination remains unconfirmed. Detection data from security vendors is limited but indicative of malicious activity. As of the latest scan, 8 out of 93 security vendors on VirusTotal flag the domain as malicious. The domain appears in one threat intelligence pulse on AlienVault OTX and is blocked by at least one security blocklist, including PhishDestroy. Gridinsoft assigns the domain a trust score of 0 out of 100, further supporting its classification as high-risk. Defenders should prioritize blocking this domain at the DNS and network levels. Given its active status and association with known malicious infrastructure, organizations should monitor for any connections to 217.195.196.7 or the identified nameservers. Additional investigation into the redirect target and any associated payment or credential harvesting mechanisms is recommended.