Phishing site svvvdddkkkllddsaa.duckdns.org impersonates Turkey's MHRS hospital appointment system
TheThreatWire flagged svvvdddkkkllddsaa.duckdns.org as a phishing site impersonating Turkey's MHRS hospital appointment system, collecting national ID numbers and passwords. It is also on the Phishing Army blocklist.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 4 November 2026 TheThreatWire flagged svvvdddkkkllddsaa.duckdns.org as a phishing site impersonating MHRS, Turkey's Central Physician Appointment System run by the Ministry of Health, in its Alert #111. A screenshot attached to the post shows an MHRS-style login page asking for a T.C. Kimlik No, the Turkish national identity number, and a password. The Phishing Army community blocklist, checked by scammers.com on 4 November 2026, also lists the domain.
How the scam works
MHRS is the national system Turkish residents use to book hospital and clinic appointments, and it is tied to the e-Devlet identity used across government services. The phishing page is hosted on a free DuckDNS subdomain made of random characters, with no connection to the official saglik.gov.tr or mhrs.gov.tr addresses. It copies the login screen and asks for the national ID number and password, credentials that can open other government and health services if they are reused.
Phishing that imitates a health-appointment system is often spread by SMS or email claiming an appointment needs to be confirmed or that a slot is available. Because the national ID number is a single identifier used widely in Turkey, handing it over along with a password can expose e-Devlet and other accounts. The Ministry of Health's services should be reached only through the official mhrs.gov.tr site, the MHRS app or the Alo 182 line, never through a link in a message. Anyone who entered details should change passwords on e-Devlet and any reused accounts and watch for misuse of their identity. The domain comes from the alert and the blocklist and has not been independently checked by scammers.com.
Source
Post by @TheThreatWire on X, 4 November 2026 (2:15 AM ET), with a screenshot of the page. Not independently verified by scammers.com.
Red flags
- An MHRS login page on a free DuckDNS subdomain of random characters.
- A request for your T.C. Kimlik No and password outside the official site.
- SMS or email pressing you to confirm a health appointment through a link.
- A domain unrelated to mhrs.gov.tr or saglik.gov.tr.
- Any reuse of the same password across government services.
If you were targeted
- 1Reach MHRS only through mhrs.gov.tr, the official app or Alo 182.
- 2Do not enter your national ID number or password on a page reached from a link.
- 3If you entered details, change your e-Devlet password and any reused passwords.
- 4Watch for unauthorised use of your identity or government accounts.
- 5Report the link to the Ministry of Health and to USOM.