formulario-davivienda-1ed9970ba3wf3[.]duckdns[.]org

The domain formulario-davivienda-1ed9970ba3wf3.duckdns.org is currently taken offline but retains a history of malicious activity that warrants high‑risk classification. Infrastructure analysis shows the hostname resolves to the AWS EC2 address 44.248.60.105 located in the United States (us‑west‑2 region). The server presents an Apache HTTP Server banner and serves a page titled “Medic Care Bootstrap 5 CSS Template”, built with Bootstrap, jQuery, OWL Carousel, and other common web‑toolkits. The site was secured with a Let’s Encrypt R12 certificate, indicating the use of a legitimate TLS certificate despite the malicious intent.

Registration was performed through the free dynamic DNS service DuckDNS, a pattern frequently observed in fast‑flux or short‑lived phishing campaigns. Threat intelligence flags the domain on at least one security blocklist, specifically PhishDestroy, and Google Safe Browsing classifies the URL as a social‑engineering threat. VirusTotal scans recorded 19 detections out of 94 vendors, confirming that multiple security products have identified the domain as malicious. The known scam type is banking phishing, targeting users with credential‑stealing tactics, though the exact financial institution being spoofed has not been disclosed in the available data.

Uncertainty remains regarding the current content of the site, as the domain is offline and no live page analysis is possible. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or resurrection of the hostname, and consider adding the IP address 44.248.60.105 to deny‑list rules. Further investigation of related subdomains or similar DuckDNS entries may reveal additional campaign infrastructure. Organizations should educate users about the risk of unsolicited links that appear to reference medical or banking services, reinforcing the importance of verifying URLs before credential entry.