dengeailemerkezi[.]com

This domain, dengeailemerkezi.com, is flagged as a credential theft operation impersonating Denge Aile Merkezi, a legitimate family counseling service based in Çorum, Turkey. Analysis of the page title, "Travma ve Travma Aktarımı - Denge Aile Merkezi, Çorum Aile Danışmanlığı," indicates an attempt to deceive visitors into believing the site belongs to the authentic counseling center. The infrastructure lacks overt signs of a crypto drainer kit or payment skimming tools, suggesting the primary objective is harvesting login credentials, personal data, or sensitive client information under the guise of professional services. No known phishing kits or exploit frameworks were detected in initial scans, but the domain’s deceptive branding aligns with credential theft campaigns targeting regional healthcare and counseling providers. Infrastructure analysis reveals concrete technical indicators of malicious activity. The domain was registered on July 05, 2023, through HOSTINGER operations, UAB, and resolves to the IP address 84.32.84.197. Security vendor assessments on VirusTotal show 2 out of 95 engines flagging the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Detected technologies include Hostinger CDN and HTTP/3, which may be leveraged to obfuscate traffic or evade detection. The use of a content delivery network and modern HTTP protocols does not inherently indicate malicious intent but is consistent with infrastructure observed in credential theft campaigns. As of the latest assessment, dengeailemerkezi.com has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the residual risk remains elevated for several reasons. The domain’s registration remains active, allowing threat actors to redeploy the infrastructure with minimal effort. Clients or employees of Denge Aile Merkezi may still be targeted via cached search results, phishing emails, or social engineering tactics referencing the fraudulent site. Organizations and individuals are advised to monitor for unauthorized access attempts, reset credentials associated with the legitimate counseling service, and verify domain authenticity before submitting sensitive information. Network defenders should block the IP address 84.32.84.197 and monitor for related domains registered under the same registrar or hosting provider.