kesingiris[.]one

Analysis of the domain kesingiris.one indicates active credential-phishing infrastructure targeting Turkish-speaking users. The domain, registered on May 26, 2026, through NameSilo, LLC, resolves to IP address 85.12.121.4.156, hosted on AS200019 (ALEXHOST SRL) in Moldova. Nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com are consistently associated with this domain, a pattern observed in other phishing campaigns leveraging the same DNS provider. The page title, 'Kesin Giriş - URL Kisaltma Servisi,' suggests a login or URL-shortening service, aligning with the credential-phishing classification. A 301 HTTP redirect is currently active, which may indicate an attempt to funnel victims toward a secondary malicious endpoint. The SSL certificate, issued by Let's Encrypt (R12), is valid and does not mitigate the malicious intent of the domain. Security vendors have flagged this domain, with 19 out of 91 detections on VirusTotal as of the latest scan. It appears on one security blocklist and has been included in five threat intelligence pulses on AlienVault OTX, further corroborating its malicious classification. The Apache HTTP Server technology detected on the domain is commonly used in phishing kits due to its widespread deployment and ease of configuration. Defenders should treat this domain as high-risk and prioritize blocking at the DNS, IP, and URL levels. The use of a URL-shortening pretext and Turkish-language content suggests targeting of regional users, though the exact brand or service being impersonated remains unconfirmed. No evidence of takedown or mitigation has been observed as of July 12, 2026, and the domain remains active.