kort[.]click

This domain is flagged at an elevated risk level for real-estate phishing, a targeted threat vector designed to deceive users through fraudulent housing investment schemes. The Turkish-language page title 'Yüzyılın Konut Projesi' (Century’s Housing Project) suggests a localized campaign aimed at Turkish-speaking audiences, likely leveraging urgency and financial incentives to extract personal or payment information. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain kort.click was registered on November 28, 2025, through Global Domain Group LLC, a registrar frequently associated with abuse-prone registrations. It resolves to IP address 172.67.71.251, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate origin servers. Despite Cloudflare’s legitimate use, the absence of an SSL certificate further undermines trust, as encrypted connections are a baseline expectation for financial or personal data transactions. Security validation engines report 17 detections out of 95 on VirusTotal, with the domain appearing on two independent blocklists: PhishDestroy and PhishingDB. These detections, combined with the domain’s recent creation and offline status, indicate a short-lived but high-impact campaign. Mitigation against real-estate phishing requires a layered defense strategy. Network-level protections should include DNS filtering to block resolution of newly registered domains (NRDs) with high-risk attributes, such as those created within the last 30 days and lacking SSL certificates. Endpoint security controls should enforce real-time URL inspection, particularly for domains hosted on content delivery networks (CDNs) with no origin transparency. User awareness programs should emphasize verification of housing offers through official developer channels, cross-referencing project names with local real estate registries, and scrutinizing payment requests for anomalies such as untraceable accounts or pressure tactics. Given the domain’s current offline status, monitoring for re-registration or rebranding under similar naming conventions (e.g., 'konutproje.click') is recommended to preempt follow-up campaigns.