tokievler[.]org

This domain, tokievler.org, is identified as a phishing site specifically targeting users of Turkey's official e-Devlet (e-Government) portal. The page title 'e-Devlet Kapısı' directly mimics the legitimate government service, suggesting an intent to deceive users into entering sensitive credentials, such as national ID numbers, passwords, or personal identification details. The domain's infrastructure and content are designed to exploit trust in government services, increasing the likelihood of successful credential harvesting or malware distribution under the guise of official communication. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. tokievler.org was registered on November 4, 2025, through HOSTINGER operations, UAB, and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). VirusTotal reports that 10 out of 95 security vendors have flagged the domain as malicious, while it appears on at least one security blocklist. The SSL certificate is issued by WE1, a provider commonly associated with low-cost or automated certificate issuance, which is frequently observed in phishing campaigns. The domain's status is currently offline, but its recent creation and rapid detection by security tools indicate a deliberate and short-lived operation. Users who visited tokievler.org or entered credentials on the site should take immediate action to mitigate potential risks. First, any passwords or sensitive information submitted should be considered compromised and changed immediately on the legitimate e-Devlet portal and any other services where the same credentials may have been reused. Second, affected users should monitor their accounts for unauthorized activity, including financial transactions, identity verification requests, or unusual login attempts. Third, devices used to access the site should be scanned for malware, as phishing pages may deploy additional payloads. Finally, users are advised to report the incident to relevant authorities, such as Turkey's Computer Emergency Response Team (CERT), to aid in tracking and disrupting the phishing infrastructure.