gxrxntibvxvi[.]duckdns[.]org

The domain gxrxntibvxvi.duckdns.org has been identified as a brand impersonation campaign targeting Garanti, a financial institution. The domain was registered through Gandi SAS on April 12, 2013, and as of the report date of July 24, 2026, it has been taken offline. The page title found during the investigation was 'İnternet Bankacılığı - Garanti,' indicating a potential attempt to mimic the online banking services of the targeted brand. The domain is currently hosted in the Netherlands (NL) and resolves to the IP address 78.159.156.48, which is part of the AS25211 Euro Crypt EOOD network.

This infrastructure setup suggests that the domain may have been used for malicious activities, although the lack of an SSL certificate indicates a lower level of sophistication in the phishing campaign. The domain is flagged by one security blocklist and is blocked by PhishDestroy, a security service. Defenders should remain vigilant and ensure that users within their network are aware of the potential risk associated with this domain.

While the domain is currently offline, it is advisable to monitor for any reactivation or related activity. Additionally, the presence of the domain on a security blocklist and its registration through a known registrar should be considered when evaluating the overall threat landscape. The elevated risk level and the specific targeting of Garanti's Internet banking services highlight the need for enhanced security measures and user education to prevent potential compromise.