duckpond[.]casa

The domain www.duckpond.casa is currently active and hosts a site titled “DuckPond | Премиальные инструменты”. The domain was registered on 19 April 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses the regway.com name server set (dns1‑dns4.regway.com). DNS resolution points to IP 132.243.18.119, which is geolocated in the United States and is associated with the NCR Voyix Corporation. An HTTPS connection is presented using a Let’s Encrypt certificate (identifier E7) and the web server returns HTTP 200. Reputation scoring is minimal, with Gridinsoft assigning a trust score of 0 out of 100. VirusTotal analysis shows a single detection out of 94 scanning engines, and the domain appears on one public blocklist, with PhishDestroy already listing it as blocked. The classification in intelligence is “generic_phishing” and the risk level is marked high. No additional details about the page content or targeted brands have been disclosed. Uncertainty remains regarding the specific phishing kit or credential collection mechanisms employed, as the site has not been publicly analyzed beyond the title. Defenders should add the domain and its IP address to outbound filtering rules, ensure TLS inspection logs capture any traffic to the host, and monitor for related indicators such as the regway.com name servers and the Let’s Encrypt certificate fingerprint. Continuous re‑scanning with multi‑engine services is advised to detect any changes in detection count, and the domain should be included in threat intelligence feeds for rapid blocklist updates.