habertry1453[.]shop

This domain, habertry1453.shop, is identified as a brand impersonation threat targeting Google, a major technology and services provider. Analysis of the page title, 'Hoş Geldiniz - Bireysel,' suggests a localized phishing campaign aimed at Turkish-speaking users, likely designed to harvest login credentials by mimicking Google’s authentication portals. No evidence of a drainer kit or cryptocurrency wallet interaction was observed in the available data, though the absence of SSL encryption and the use of a generic registrar further indicate malicious intent. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on May 16, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 83.142.209.37, which has been linked to other phishing infrastructure in prior campaigns. Detection metrics from VirusTotal indicate that 19 out of 95 security vendors flag the domain as malicious, while only one security blocklist currently includes it. The domain does not appear in Google Safe Browsing (GSB) databases at the time of analysis, though this may reflect a lag in detection rather than benign status. As of the latest assessment, habertry1453.shop has been taken offline, reducing immediate exposure to end users. However, the elevated risk level persists due to the domain’s recent registration, lack of SSL certification, and the potential for reactivation or migration to alternative infrastructure. Organizations and individuals are advised to monitor for similar domains registered under the same registrar or resolving to the identified IP address. Users who may have interacted with the domain should reset credentials for any associated accounts and enable multi-factor authentication where available. Proactive blocking of the IP 83.142.209.37 at the network level is recommended to mitigate residual risk.