avantajli[.]sbs

This domain, avantajli.sbs, is identified as a brand impersonation threat targeting Ziraat Bank, a major financial institution. The site mimics the bank's official login portal, presenting a page titled 'Online İşlemler | Giriş Ekranı' to deceive users into entering credentials. No crypto drainer or malware payloads were explicitly linked to this domain, but the impersonation of a banking login page aligns with credential harvesting tactics commonly used in financial fraud. Analysis indicates the domain was registered on January 02, 2026, through Dynadot LLC, a registrar frequently utilized for malicious infrastructure. It resolves to the IP address 167.99.38.75, hosted on AS14061 (DigitalOcean, LLC) in the Netherlands. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The domain lacks an SSL certificate, increasing the likelihood of detection by browser security mechanisms. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, likely taken down following detection by security systems. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or reuse the hosting IP for future campaigns. Users who accessed the site should assume credential exposure and initiate password resets, while monitoring for unauthorized transactions. Organizations should update blocklists to include the domain and IP, and conduct retrospective log analysis to identify any prior interactions with this infrastructure.