kureker41645345[.]duckdns[.]org

The domain kureker41645345.duckdns.org was registered on February 27, 2026 through Gandi SAS and is currently listed as taken offline. DNS resolution points to the IPv4 address 94.183.168.45, which is announced by AS213995 (Belenkii Ivan Alexandrovich) and geolocated to Russia. No SSL certificate is presented for the host, indicating that HTTPS connections are not available. The HTTP response historically served a page titled "Privspeed Bulletproof Plesk," a title commonly associated with hosting control panels rather than a legitimate brand, suggesting the site was used as a generic phishing front.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that threat‑intelligence feeds have flagged it as malicious. VirusTotal scans show that 15 of 93 antivirus and URL‑reputation engines returned a positive detection for the domain, reinforcing the suspicion of phishing activity. No additional evidence such as Safe Browsing, OTX indicators, or further blocklist entries is available at this time. The observable infrastructure—dynamic DNS provider, Russian‑based IP, lack of TLS, and the blocklist inclusion—provides a consistent picture of a low‑cost, disposable phishing hosting environment.

Defenders should continue to deny any network traffic to this host, ensure that outbound connections to 94.183.168.45 are blocked at perimeter firewalls, and add the domain to internal blocklists. Monitoring for any re‑registration attempts on duckdns.org or related subdomains is advisable, as threat actors often recycle similar dynamic DNS names. Because the site is offline, content analysis is not possible, but the existing indicators are sufficient to treat the domain as a confirmed phishing source.