toki-gov-tr-fatih[.]vercel[.]app

This domain, toki-gov-tr-fatih.vercel.app, is identified as a high-risk phishing site impersonating e-Devlet Kapısı, the official Turkish government digital service portal. The threat type is classified as generic_phishing, with the campaign actively targeting users seeking government services. As of the latest analysis, the domain remains operational and continues to pose a significant risk to individuals attempting to access legitimate e-government platforms. Infrastructure analysis reveals the domain is registered through Vercel Inc., a hosting provider frequently exploited for phishing due to its free and easily deployable services. The domain resolves to the IP address 216.198.79.131, which has been associated with multiple phishing campaigns in recent months. Detection metrics indicate that 7 out of 95 security vendors on VirusTotal have flagged this domain as malicious, reflecting a moderate but concerning level of detection. The page title, e-Devlet Kapısı, directly mimics the legitimate portal, increasing the likelihood of successful credential harvesting from unsuspecting users. Current status confirms the domain remains active, with no evidence of takedown or mitigation efforts. Users are strongly advised to avoid interacting with this domain and to verify the authenticity of any e-government portal by accessing it directly through official channels. Organizations should update their blocklists to include this domain and its associated IP address, while monitoring for similar patterns in newly registered domains under Vercel or other hosting providers. Enhanced user education on recognizing phishing indicators, such as suspicious subdomains or mismatched URLs, is recommended to mitigate the risk of credential compromise.