haberler2026[.]co

The domain haberler2026.co has been assessed as having an elevated risk level due to its involvement in generic phishing activities. This domain mimics the page title of a legitimate internet banking service, specifically 'İnternet Bankacılığı - Garanti,' which indicates an intent to deceive users and potentially steal sensitive information such as login credentials and financial data.

Analysis indicates that the domain was created on March 12, 2026, and is registered through Tucows Domains Inc. The domain resolves to the IP address 64.89.161.43, which is located in Luxembourg (LU) and is part of the AS205759 Ghosty Networks LLC. It appears on one security blocklist, and 23 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The SSL certificate used by the domain is identified as R13, which may provide a false sense of security to unsuspecting users. The domain is currently offline, suggesting that it may have been taken down or is no longer active.

To mitigate the risks associated with this phishing domain, users are advised to verify the URL and SSL certificate of any internet banking site they visit, ensuring it matches the official domain of their financial institution. Security teams should monitor for any similar domain names and IP addresses that may be used in future campaigns. Additionally, implementing multi-factor authentication (MFA) can significantly reduce the likelihood of unauthorized access even if login credentials are compromised. Users should also be educated on the signs of phishing and encouraged to report any suspicious activities to their security team or financial institution.