evimeyol[.]click

This domain, evimeyol.click, is flagged as an elevated-risk credential theft phishing site designed to harvest login credentials and personal information from victims under the guise of a high-value real estate project. Analysis indicates the site impersonates legitimate property investment opportunities, leveraging the page title 'Yüzyılın Konut Projesi' (translated: 'Century’s Housing Project') to deceive users into submitting sensitive data. The infrastructure and content suggest a targeted campaign aimed at Turkish-speaking audiences, though the hosting and registration patterns indicate broader operational capabilities. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on November 25, 2025, through Global Domain Group LLC, a registrar frequently associated with abusive registrations. It resolves to the IPv6 address 2606:4700:20::681a:fec, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin servers and evade detection. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 21 out of 95 security vendors on VirusTotal. Notably, the site lacks an SSL certificate, a critical red flag for credential theft operations, as unencrypted connections expose submitted data to interception. The creation date, combined with the rapid appearance on blocklists, suggests a short-lived, high-velocity attack pattern typical of phishing campaigns. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address at the network perimeter. Organizations should deploy email and web filtering rules to prevent delivery of messages containing links to evimeyol.click or similar domains registered through Global Domain Group LLC. End-user education should emphasize the risks of credential submission on unencrypted sites, particularly those promoting time-sensitive financial opportunities. Security teams are advised to monitor for follow-up domains using the same registrar or hosting provider, as threat actors often rotate infrastructure. Incident response protocols should include forced password resets for any accounts potentially exposed through this campaign, with priority given to credentials tied to financial or real estate transactions.