kontroldosyam[.]com

Analysis of kontroldosyam.com shows a recently registered domain (creation date February 21, 2026) that was actively serving a page titled "e-Devlet Kapısı" before being taken offline. The domain resolves to the IP address 172.67.168.187, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Cloudflare hosting is commonly leveraged by threat actors to hide true infrastructure, and the use of a shared service does not provide direct attribution of the underlying operator. The SSL certificate associated with the domain is identified as "WE1," a designation often observed in automatically‑issued certificates that lack strong validation.

Reputation signals are uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on a single security blocklist, and PhishDestroy has explicitly blocked it. VirusTotal scans report that eight of ninety‑three security vendors flagged the domain, indicating detectable malicious characteristics, while AlienVault OTX lists the domain in thirteen independent threat pulses, reinforcing its association with phishing campaigns. The page title "e-Devlet Kapısı" suggests an attempt to impersonate a Turkish government portal, a common lure in credential‑stealing operations.

Because the site is currently offline, real‑time URL or content observation is not possible, and the exact payload or credential‑capture mechanism remains unknown. defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurrection of the host on the same IP or similar Cloudflare‑protected assets, and update detection rules to include the observed page title and the specific SSL fingerprint. Correlation with the eight vendor detections and OTX pulse identifiers can aid in broader campaign attribution and help prioritize remediation of compromised credentials linked to the e‑Devlet service.