evindeyiz[.]click

The domain evindeyiz.click was observed delivering a generic phishing campaign targeting users of the Turkish e‑Government portal, as indicated by the page title “e‑Devlet Kapısı”. The domain was registered on 25 November 2025 through Global Domain Group LLC and resolves to the IPv6 address 2606:4700:20::681a:f90, which is hosted by Cloudflare, Inc. (AS13335) in the United States. The site was taken offline and is currently listed as blocked by the PhishDestroy sinkhole, confirming that the infrastructure has been disrupted. Reputation data show that the domain appears on a single security blocklist and carries a Gridinsoft trust score of 0 out of 100, reflecting a very low confidence in its legitimacy.

An SSL certificate identified as “WE1” is present, but the certificate details have not been disclosed, and the presence of TLS does not mitigate the phishing risk. Threat intelligence from AlienVault OTX references the domain in fourteen separate pulses, indicating that it has been shared among multiple analysts. VirusTotal scans report that sixteen of ninety‑five security vendors flagged the domain, reinforcing its malicious classification. The page title alone suggests an attempt to lure Turkish citizens into entering credentials for the e‑Government service, although the exact content of the landing page has not been publicly released.

At this time, the precise phishing kit or credential‑harvesting mechanism remains unknown. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any re‑hosting attempts that may use the same registrar or Cloudflare infrastructure. Ongoing observation of related IPv6 ranges and any future registrations from Global Domain Group LLC for similar Turkish‑language phishing campaigns is recommended.