subvps23[.]duckdns[.]org

Analysis of the domain subvps23.duckdns.org indicates it was actively involved in a credential harvesting operation prior to being taken offline on July 24, 2026. The domain was registered on February 21, 2026, through Gandi SAS and utilized dynamic DNS provider DuckDNS, as evidenced by its nameservers (ns1.duckdns.org, ns2.duckdns.org, ns3.duckdns.org). Infrastructure analysis reveals the domain resolved to the IP address 77.110.103.90, hosted on AS210644 (AEZA GROUP LLC) in Germany. The absence of an SSL certificate further aligns with common phishing infrastructure patterns, reducing the likelihood of encrypted traffic interception warnings for potential victims. The page title, 'Subvps23: Authtentication Page,' contains a typographical error ('Authtentication'), a tactic frequently observed in low-effort phishing campaigns to bypass basic keyword filters while maintaining the appearance of a legitimate authentication portal.

No brand or service is explicitly named in the available data, limiting classification to a generic credential harvesting attempt. The domain's MX records point to itself (priority 50), a configuration often employed to receive stolen credentials directly via email. Detection metrics at the time of analysis were minimal but indicative of malicious activity. VirusTotal reported a single detection from 93 security vendors, while PhishDestroy had already blocked the domain. The domain appeared on one security blocklist, and Gridinsoft assigned a trust score of 0/100.

The HTTP status returned a 404 error at the time of assessment, suggesting the site was either dismantled or temporarily disabled. Defenders should treat this domain as part of a broader phishing campaign leveraging dynamic DNS services to evade static blocklists. The use of DuckDNS nameservers and a hosting provider with a history of abuse (AEZA GROUP LLC) warrants monitoring of related subdomains or IPs within the same ASN.