toplukonutbasvurusp[.]vercel[.]app

This domain, toplukonutbasvurusp.vercel.app, is flagged as a credential phishing site impersonating e-Devlet Kapısı, the Turkish government digital services portal. Analysis indicates the threat actor designed the page to harvest login credentials, likely targeting citizens accessing official services. No drainer kit signatures were observed, but the site employs static form fields mimicking legitimate authentication workflows, a common tactic in government-themed phishing campaigns. Infrastructure analysis reveals the domain resolves to IP address 216.198.79.131 and is hosted through Vercel Inc., a platform frequently abused for rapid phishing deployment. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. VirusTotal detection shows 13 out of 95 security vendors flag the domain as malicious. Google Safe Browsing status is currently unconfirmed, and no blocklist entries beyond VirusTotal were identified at the time of analysis. The page title explicitly uses "e-Devlet Kapısı," reinforcing the impersonation attempt. The domain remains active and poses an elevated risk to users unfamiliar with official e-Devlet domains. Response actions include immediate submission to threat intelligence feeds and domain reputation services for broader detection. While hosting provider abuse reports have been filed, the low-friction nature of Vercel deployments allows threat actors to quickly redeploy similar infrastructure. Users are advised to verify domain authenticity via official e-Devlet channels and enable multi-factor authentication where available. Organizations should monitor for credential reuse attempts from harvested accounts.