garantigiris[.]one

Garanti Bank customers are targeted by the phishing domain garantigiris.one, which mimics the bank's login page. The site is hosted on IP 85.121.4.103 in Moldova and was registered through NameSilo, LLC. Despite being taken down, it was flagged as malicious by 4 out of 95 vendors on VirusTotal. PhishDestroy lists it in its public blocklist, highlighting its threat potential.

The domain's SSL certificate was issued by Let's Encrypt, a common choice for malicious actors due to its free and automated nature. The phishing operation was detected by PhishDestroy on May 28, 2026, just eight days after its creation. This quick detection underscores the importance of early identification in mitigating phishing threats.

Phishing domains like garantigiris.one exploit the initial period after registration, often going undetected by major antivirus databases for 24-72 hours. PhishDestroy's proactive monitoring captures these threats in this critical window, providing an edge in threat intelligence. Although the domain is now offline, its presence in blocklists serves as a reminder of the ongoing risks posed by phishing scams.