cd[.]dvrcam[.]info

The domain cd.dvrcam.info was observed hosting a credential‑phishing page that presented the title “AMSTEL REGISTRATION.” The site is currently offline, returning an HTTP 200 response before takedown and is listed on a single security blocklist, where it is actively blocked by the PhishDestroy service. VirusTotal analysis recorded one positive detection out of ninety‑four scanning engines, indicating at least one vendor identified malicious behavior. The domain resolves to the IPv4 address 91.234.194.20, which belongs to a French hosting provider identified as Groupe LWS SARL and is registered through the LWS registrar (lws.fr).

TLS negotiation uses a Let’s Encrypt certificate, and the server advertises HTTP/3 support. The hosting location and certificate chain appear legitimate, but the combination of a suspicious page title, the blocklist entry, and the VirusTotal detection suggests purposeful abuse for credential harvesting, specifically targeting Amstel‑related credentials. No additional intelligence such as malware families, campaign identifiers, or victim reports is available, leaving the broader scope of the operation uncertain.

Defenders should add cd.dvrcam.info to blocklists, monitor the associated IP address for any re‑use, and consider tightening controls on outbound connections to Let’s Encrypt‑issued services hosted by LWS. Continuous observation of the registrar’s activity may reveal future domains that reuse the same infrastructure.