toplukonut7129215215[.]vercel[.]app

This domain is flagged as a high-risk phishing site specifically designed to impersonate e-Devlet Kapısı, a Turkish government portal. Analysis indicates the threat type is a fake login page, likely targeting users to harvest credentials through deceptive authentication forms. The domain exhibits multiple technical indicators of malicious activity, aligning with known phishing infrastructure patterns. Infrastructure analysis reveals the following data points: the domain is registered through Vercel Inc. and resolves to IP address 216.198.79.195, hosted on Amazon.com, Inc. (AS16509) in the United States. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WR1), and the domain appears on one security blocklist. The page title explicitly mimics e-Devlet Kapısı, reinforcing its impersonation tactics. No creation date is available, but the domain remains active as of the latest verification. Mitigation steps for this specific threat type include immediate blocking of the domain and IP address (216.198.79.195) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems, including the domain, IP, and SSL certificate thumbprint. Users should be educated to verify the legitimacy of government portals by checking for official HTTPS certificates and domain names before entering credentials. If credentials were entered, immediate password resets and multi-factor authentication (MFA) enablement are recommended for affected accounts.