toplukonutbalk[.]vercel[.]app

This domain, toplukonutbalk.vercel.app, is under investigation for credential phishing targeting users of the Turkish government portal e-Devlet Kapısı. The page title explicitly mimics the legitimate e-Devlet login interface, suggesting an intent to harvest authentication credentials through social engineering. No associated drainer kit or cryptocurrency wallet addresses were identified in initial analysis, though further inspection of the page source and network traffic is required to confirm the absence of automated exfiltration mechanisms.

Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure, resolving to the IP address 216.198.79.131. The SSL certificate is issued by Google Trust Services, a common provider for both legitimate and malicious domains. VirusTotal reports 0 detections out of 95 engines, indicating the domain has not yet been widely flagged by security vendors. No creation date is publicly available through standard WHOIS or passive DNS records, limiting temporal analysis. Google Safe Browsing (GSB) status remains unconfirmed at this stage, and no blocklist entries were identified in initial checks. The domain's registration through Vercel, a platform frequently abused for rapid deployment of phishing pages, aligns with observed tactics in similar campaigns.

Current status is marked as active, with ongoing monitoring to assess victim interaction and potential credential harvesting. Immediate response actions include submission to additional threat intelligence platforms for broader detection coverage and coordination with the hosting provider for potential takedown. The risk level remains under investigation due to the lack of prior detections, though the domain's impersonation of a high-value government service warrants elevated scrutiny. Organizations are advised to block access to the domain at the network level and monitor for any outbound connections to 216.198.79.131. End users should be alerted to verify the authenticity of e-Devlet login pages, particularly those hosted on non-governmental domains, and report any suspicious activity to their security teams.