kamusorgulama[.]net

The domain kamusorgulama.net has been assessed as high risk due to its classification as a Plesk Obsidian phishing threat. This specific type of phishing targets users of the Plesk hosting control panel, attempting to steal credentials or sensitive information under the guise of a legitimate login page. The domain remains active, posing an ongoing risk to unsuspecting visitors.

VirusTotal data reveals that 17 out of 95 security vendors flag this domain as malicious, indicating broad consensus among the security community. The domain is registered through NameSilo, LLC, a common registrar for phishing operations, and was created on October 15, 2025, making it relatively new. It resolves to the IP address 172.67.179.217 and appears on one security blocklist. Additionally, AlienVault OTX has recorded it in 5 threat intelligence pulses, further corroborating its malicious nature. Notably, the domain lacks an SSL certificate, which is a red flag for any site claiming to be a Plesk login page, as legitimate services would use HTTPS.

To mitigate the risk posed by this domain, organizations should block access to kamusorgulama.net at the network level and ensure that any users who may have visited it are alerted to change their Plesk credentials immediately. PhishDestroy recommends implementing email filtering rules to detect and quarantine any messages containing links to this domain, as well as conducting security awareness training to help users identify phishing attempts that mimic legitimate control panel interfaces. Regular monitoring of login logs for unauthorized access attempts is also advised.