kredindijitalden[.]sbs

Analysis indicates that kredindijitalden.sbs is a brand-impersonation domain targeting Ziraat Bank, assessed as elevated risk and currently offline. The domain was registered on October 23, 2025, through Dynadot LLC and resolved to IP address 167.99.38.75, hosted on DigitalOcean's infrastructure (AS14061) in the Netherlands. No SSL certificate was detected. The page title, 'Hoş Geldiniz | Güvenli Portal,' aligns with common phishing tactics used to mimic financial institutions, though the exact content and functionality of the site remain unconfirmed due to its offline status.

Infrastructure analysis reveals the domain uses nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. Security vendors have flagged the domain: 15 of 95 engines on VirusTotal detected malicious activity, and it appears on one security blocklist. AlienVault OTX records show the domain in 16 threat intelligence pulses, further corroborating its association with phishing campaigns. The domain was blocked by PhishDestroy, a specialized anti-phishing service.

Defenders should treat this domain as compromised infrastructure. While the site is currently offline, the registration and detection timelines suggest it was active in phishing operations. Organizations are advised to block the domain and IP at perimeter controls, monitor for related domains registered through the same registrar or nameserver infrastructure, and alert users to potential Ziraat Bank impersonation attempts. No evidence links this domain to other scam categories or brands beyond the stated target.