evsahibiturkiyem[.]com

This domain, evsahibiturkiyem.com, presents a counterfeit Plesk Obsidian 18.0.73 login interface designed to harvest administrative credentials. Analysis indicates the threat type is classified as generic_phishing, targeting system administrators or hosting account holders who may be deceived into entering valid credentials on the fraudulent portal. The page title explicitly mimics legitimate Plesk control panel software, increasing the likelihood of successful social engineering against technical users managing web infrastructure. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on November 07, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive registrations. It resolves to the IP address 45.10.243.93, hosted on AS57724 (DDOS-GUARD LTD) in Russia, a network segment commonly exploited for phishing and bulletproof hosting. Detection metrics show 14 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on one additional security blocklist. Notably, the domain lacks an SSL certificate, further deviating from legitimate Plesk deployments that universally employ TLS encryption. Users who accessed evsahibiturkiyem.com or entered credentials on the site should immediately revoke and rotate all exposed passwords, particularly those associated with hosting, domain management, or financial systems. System administrators are advised to check logs for connections to 45.10.243.93 and the domain itself, as these may indicate successful credential capture. Network-level blocking of the IP and domain is recommended to prevent further exposure. Organizations should also review recent Plesk login attempts for anomalies and enable multi-factor authentication on all critical accounts to mitigate the risk of credential-based attacks.