buyukeczane[.]org

This domain, buyukeczane.org, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials through fraudulent web forms. Analysis indicates the infrastructure was configured to mimic legitimate services, likely targeting individuals in Turkish-speaking regions given its hosting and registration details. The site operated under the guise of a pharmacy or health-related portal, a common tactic to exploit trust in medical services and prompt urgent user interaction. Infrastructure analysis reveals concrete indicators of malicious activity. The domain was registered on March 28, 2018, through a Turkish registrar, ODTÜ Geliştirme Vakfi Bilgi Teknolojileri Sanayi Ve Ticaret Anonim Şirketi, and resolves to the IP address 176.53.12.17, hosted by AS42926 Radore Veri Merkezi Hizmetleri A.S. in Turkey. Security vendors on VirusTotal flagged the domain as malicious, with 21 out of 95 engines detecting it as a phishing threat. Additionally, the domain appears on two security blocklists, and its SSL certificate, issued by Let's Encrypt, was likely used to lend a false sense of legitimacy to the fraudulent site. The page title, Index of /, suggests an exposed directory structure, which is atypical for legitimate services and often indicative of hastily deployed phishing infrastructure. Users who visited buyukeczane.org or entered credentials on the site should take immediate action to mitigate potential compromise. First, reset passwords for any accounts that may have been entered on the site, prioritizing email, financial, and healthcare-related services. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as unrecognized logins or transactions, and report any suspicious behavior to the respective service providers. If financial information was submitted, contact the relevant institutions to place fraud alerts on accounts. Finally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads to harvest further data or maintain persistence.