basvurularinizbizimle[.]duckdns[.]org

Analysis of basvurularinizbizimle.duckdns.org indicates that the domain was registered through the free dynamic DNS service DuckDNS and first observed on 21 February 2026. The hostname resolves to the IPv4 address 195.96.129.27, which is allocated to an InterLIR Marketplace network in the Netherlands. VirusTotal reports that 14 of 93 scanning engines flag the domain as malicious, reflecting a consensus of detection across multiple vendors. The domain is listed on a single public blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service has categorized it as a threat.

The current operational status is offline, meaning the web service is no longer reachable, but the underlying infrastructure remains registered and could be re‑activated. No public SSL certificate information, HTTP response codes, or page‑title metadata have been disclosed, so the content served when the domain was active cannot be verified. Likewise, Safe Browsing and OTX entries are not referenced in the available intelligence. The lack of additional contextual data limits the ability to attribute a specific phishing campaign or target brand, but the aggregate evidence—free DNS registration, malicious detection count, blocklist inclusion, and association with a known phishing‑blocking feed—supports an elevated risk rating.

Defenders should continue to block the domain at DNS and proxy layers, monitor the IP address 195.96.129.27 for any resurgence of activity, and consider adding the host to internal threat‑intel feeds. Periodic re‑query of VirusTotal and blocklist sources is advised to capture any future re‑classification. Because the domain is already offline, immediate impact is low, yet the infrastructure could be reused for new phishing operations.