bsvrlrm[.]click

Analysis of bsvrlrm.click indicates a credential-phishing domain targeting the Turkish Government's e-Devlet portal. The domain, registered on October 14, 2025, through Atak Domain Bilgi Teknolojileri AS, resolves to IP 196.251.88.139 (Netherlands) and uses nameservers ns1.bsvrlrm.click, ns2.bsvrlrm.click, ns1.plesk.axxel1.com, and ns2.plesk.axxel1.com. No SSL certificate is present. The page title 'e-Devlet Kapısı' directly matches the official Turkish Government portal, confirming brand impersonation.

Detection data shows elevated risk: 18 of 95 security vendors on VirusTotal flag the domain, and it appears in 18 AlienVault OTX threat intelligence pulses. The domain is listed on one security blocklist and blocked by PhishDestroy. Trust scores are consistently low, with Scamadviser and Gridinsoft assigning 1/100 and 0/100, respectively. Infrastructure analysis reveals the domain is currently offline, though prior activity likely involved credential harvesting or malware distribution.

Defenders should treat this domain as high-confidence phishing infrastructure. Block the domain and IP at network perimeters, and monitor for related nameserver or hosting provider reuse. Turkish Government entities and users should be alerted to potential credential exposure from prior campaigns. No evidence links this domain to a specific phishing kit, and exact page content remains unanalyzed.