yardim[.]sbs

PhishDestroy first observed yardim.sbs on Sep 11, 2025. Stored content metadata identifies Ziraat Bank as the apparent target. The captured page title is “Resmi Portal | Güvenli Giriş Sistemi”. Stored page analysis classifies the content as brand impersonation. Current evidence score: 95/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, URLQuery, and URLScan. VirusTotal recorded 15 detections among 95 engines: alphaMountain.ai, ArcSight Threat Intelligence, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Lionic, Phishing Database, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Feb 23, 2026 at 05:33 UTC. URLQuery recorded 100 detections; no observation timestamp was retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Ziraatbank and assigned phishing as its category on Jul 29, 2026 at 03:41 UTC. Non-positive and contextual checks: AlienVault OTX listed 16 community pulse references (not vendor detections) on Mar 1, 2026 at 23:23 UTC. The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:29 UTC; content was unavailable. Registration records for the domain list Dynadot LLC as the registrar and Sep 9, 2025 as the creation date. Registration preceded first observation by 2 days. At collection time, the hostname resolved to 142.93.171.36 on AS14061 (DIGITALOCEAN-ASN, US). The recorded endpoint location is Frankfurt am Main, DE. The stored server header is nginx. DOM analysis on Apr 23, 2026 at 19:24 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 2 visual captures from PhishDestroy and URLScan.

The content indicators and 3 positive source findings support the current Ziraat Bank-themed brand impersonation classification.