girisguncel3[.]co

Analysis of the domain girisguncel3.co indicates an active credential-phishing operation targeting Turkish-language users. The domain was registered on July 29, 2026, through Global Domain Group LLC, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to the IP address 183.81.169.79, hosted on nameservers ns1.nodedicated.com and ns2.nodedicated.com, a configuration commonly observed in phishing infrastructure due to its low-cost and ephemeral hosting characteristics. Detection data provides further evidence of malicious intent: the domain appears on two security blocklists, PhishDestroy and OpenPhish, both of which specialize in real-time phishing detection. VirusTotal reports that 12 of 91 security vendors flag the domain as malicious, indicating moderate but not universal consensus among detection engines.

No contradictory evidence, such as Google Safe Browsing or additional threat intelligence platforms, is currently available in the provided data. The domain name itself, 'girisguncel3.co', translates loosely to 'current login' or 'updated login' in Turkish, suggesting an attempt to deceive users into entering credentials under the pretense of account verification or system updates. The use of a numeric suffix ('3') is consistent with phishing campaigns that rapidly cycle through similar domains to evade detection and takedown efforts. No specific brand or service is named in the available evidence, so the exact target (e.g., banking, email, or social media) remains unconfirmed.

Defenders should prioritize blocking this domain at the DNS and network level, particularly in environments serving Turkish-speaking users. The domain's recent registration, low detection diversity, and use of a high-risk registrar and hosting provider justify a high-risk classification. Further analysis of the resolved IP (183.81.169.79) may reveal additional associated domains, enabling broader mitigation.