bsvrlrmtrkye[.]digital

This domain, bsvrlrmtrkye.digital, is flagged for brand impersonation targeting the Turkish Government's e-Devlet Kapısı portal. Analysis indicates the threat type aligns with credential harvesting and identity fraud, leveraging official branding to deceive users into submitting sensitive authentication details. No associated drainer kit signatures were identified, though the domain's structure and hosting patterns suggest automated deployment typical of large-scale phishing operations. Infrastructure analysis reveals the domain was registered on October 16, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently observed in malicious campaigns. It resolves to the IP address 196.251.88.139, geolocated in the Netherlands, a common hosting jurisdiction for bulletproof infrastructure. VirusTotal detection metrics report 18 out of 95 security vendors flagging the domain as malicious, while it appears on a single blocklist. The absence of an SSL certificate further reduces legitimacy, as modern phishing sites typically employ encryption to evade detection. No entries were found in Google Safe Browsing at the time of analysis. The domain has since been taken offline, likely due to automated takedown mechanisms or hosting provider intervention. However, the elevated risk persists due to the domain's recent creation and the registrar's history of abuse. Organizations and users are advised to monitor for similar domains registered under the same registrar or resolving to the identified IP range. Proactive measures include implementing DNS-based blocking for the IP 196.251.88.139 and domains with analogous naming patterns. Security teams should prioritize reviewing logs for connections to this infrastructure, particularly from networks accessing Turkish Government services.