vkfsizlerle[.]duckdns[.]org

On 19 July 2026 the domain vkfsizlerle.duckdns.org was observed serving an HTTP 200 response with the page title “Şifre ile Giriş - Kolay ve Güvenli Erişim | VakıfBank”. The title explicitly references VakıfBank, indicating the site is being used to lure victims into providing credentials for that financial institution. The domain is hosted on the IP address 31.56.209.3, which resolves to a network in the Netherlands operated by Swissnet LLC. The server presents a valid Let’s Encrypt certificate (YR1) for the DuckDNS sub‑domain, which does not provide any authentication of the underlying operator. DNS records show a single MX entry with priority 50 pointing back to the same host, a configuration typical of low‑complexity phishing infrastructure. The domain appears on one public blocklist and is actively blocked by the PhishDestroy service. Google Safe Browsing classifies the site as a social‑engineering threat, and VirusTotal reports that 20 of 91 scanned security vendors flag the domain as malicious. The registration is through the free dynamic‑DNS service DuckDNS, which obscures the true registrant. No additional infrastructure such as C2 servers or payload delivery points has been identified. Analysts should add vkfsizlerle.duckdns.org to internal blocklists, monitor DNS queries for the associated IP, and enforce credential‑verification controls for any traffic targeting VakıfBank login portals. Continued observation is recommended to detect any evolution of the hosting or content.