paie-lebon[.]duckdns[.]org

This domain, paie-lebon.duckdns.org, is identified as a credential theft operation impersonating the Leboncoin platform, a classified advertisements service. Analysis of the page title, 'leboncoin - connexion,' confirms the targeting of users attempting to log in, where credentials are likely harvested for unauthorized account access or resale. No evidence of a crypto drainer kit or payment interception was observed, distinguishing this as a focused credential harvesting campaign rather than a broader financial fraud scheme. Technical indicators reveal the domain was flagged by 18 out of 95 security vendors on VirusTotal, with additional detections by at least one security blocklist. Infrastructure analysis shows the domain resolves to the IP address 64.89.160.102, hosted under AS205759 (Ghosty Networks LLC) in Luxembourg. The domain is registered through DuckDNS, a dynamic DNS provider often exploited for short-lived malicious operations. The SSL certificate, issued by Let's Encrypt (serial number YR2), suggests an attempt to appear legitimate, though the use of a free certificate authority is common in low-effort phishing infrastructure. No Google Safe Browsing (GSB) detections were explicitly noted, though the domain was blocked by independent security systems prior to takedown. As of the latest assessment, paie-lebon.duckdns.org has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the elevated risk classification remains due to the domain's recent activity and the potential for reemergence under a similar or altered infrastructure. Users who accessed the site should assume credential exposure and initiate password resets on the legitimate Leboncoin platform, as well as any other services where identical credentials may have been reused. Organizations are advised to monitor for related domains using the 'leboncoin' brand and DuckDNS registrations, as threat actors often rotate infrastructure to evade detection. The use of dynamic DNS providers for phishing remains a persistent tactic, warranting heightened scrutiny of such domains in network traffic and email filtering systems.