vaslosalco[.]co

This domain, vaslosalco.co, is identified as a credential theft operation impersonating a legitimate Turkish news portal under the title 'HABER PORTALIM: Son Dakika Haberler ile Türkiye’nin Haber Kaynağı.' Analysis indicates the site was designed to harvest user credentials through deceptive login prompts, likely leveraging the trust associated with news media brands. No direct evidence of crypto drainer or payment skimming kits was observed, though credential theft remains the primary threat vector for downstream financial fraud or account takeovers. Infrastructure analysis reveals the domain was registered through Dynadot Inc on June 21, 2026, an anomalous future date suggesting potential registry manipulation or data obfuscation. It resolves to the IP address 217.60.195.178, hosted on AS209373 (SWISSNET LLC) in the Netherlands. Detection metrics show 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The SSL certificate, issued by Let's Encrypt (YR2), provides minimal assurance, as it is commonly exploited by threat actors for short-lived campaigns. As of the latest assessment, vaslosalco.co has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure—including its registrar and hosting provider—remains active, leaving open the possibility of redeployment under a similar scheme. Organizations are advised to monitor for related indicators, including the IP 217.60.195.178 and domains registered through Dynadot with future creation dates. Users should verify news portals via official sources and report suspicious login prompts to security teams for further analysis.