ynlendirdstmkrkmayav[.]duckdns[.]org

This site, with the page title "İnternet Bankacılığı - Garanti", is a phishing page impersonating a Turkish banking brand. It poses a credential theft threat by attempting to capture sensitive login information from users of the targeted financial institution.

Technical evidence shows the domain was flagged by 14 out of 95 VirusTotal vendors, including alphaMountain.ai, BitDefender, CyRadar, Emsisoft, and Fortinet. The domain is registered through DuckDNS and hosted on IP address 64.89.160.131, which is assigned to AS205759 Ghosty Networks LLC in Luxembourg. The site uses a Let's Encrypt SSL certificate with issuer YR2, and its nameservers are listed as NS_NOT_FOUND. The GridInSoft trust rating is 0 out of 100.

The site is currently offline or down, but the DOM risk score is 73 out of 100, indicating a high risk profile. The registrar and hosting provider details suggest it was likely a temporary or disposable infrastructure for the phishing campaign.