yardim[.]sbs

Analysis of the domain yardim.sbs indicates a confirmed brand impersonation campaign targeting Ziraat Bank, classified as elevated risk. The domain was registered on September 09, 2025, through Dynadot LLC and resolved to IP 142.93.171.36, hosted on AS14061 (DigitalOcean, LLC) in Germany. No SSL certificate was present at the time of assessment. The page title, 'Resmi Portal | Güvenli Giriş Sistemi,' aligns with Turkish-language banking portals, supporting the brand impersonation classification. Infrastructure analysis reveals the domain used nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, a pattern observed in other phishing operations.

AlienVault OTX recorded 16 threat intelligence pulses referencing this domain, while 15 of 95 security vendors on VirusTotal flagged it as malicious. The domain appears on one security blocklist and was blocked by PhishDestroy prior to being taken offline. Gridinsoft assigned a trust score of 0/100, reflecting high confidence in malicious classification. Defenders should treat this domain as a confirmed phishing endpoint.

Although currently offline, the infrastructure (IP, nameservers, registrar) may be reused for future campaigns. Historical DNS records and WHOIS data should be preserved for forensic correlation. Monitoring for re-registration or IP reuse under new domains is recommended. No evidence of credential harvesting kits or specific payloads was provided; further analysis requires access to archived page content or network traffic logs.