beylikduzun[.]com

This domain, beylikduzun.com, is actively facilitating credential harvesting through a fake login portal designed to mimic legitimate authentication pages. Analysis indicates the infrastructure is engineered to deceive users into submitting sensitive login credentials, which are then exfiltrated to attacker-controlled servers. The threat is classified as a generic phishing operation, though the exact impersonated brand or service remains unconfirmed due to the lack of SSL encryption and minimal public exposure of the phishing kit's source code. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on March 12, 2026, through GMO Internet, Inc., a registrar frequently associated with malicious registrations. It resolves to the IP address 104.206.200.21, located in the United States, and currently lacks an SSL certificate, increasing the likelihood of interception or detection by network security tools. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. Despite these detections, the domain remains active, suggesting either evasion tactics or delayed takedown responses. Users who have visited beylikduzun.com or entered credentials on any page hosted under this domain should assume their login details have been compromised. Immediate actions include resetting passwords for any accounts accessed during the exposure window, enabling multi-factor authentication where available, and monitoring associated accounts for unauthorized activity. Network administrators are advised to block the domain and its resolving IP at the perimeter level. Given the domain's persistence and lack of SSL, further monitoring of related infrastructure is recommended to identify potential lateral movement or secondary payload delivery.