degaro15sw[.]duckdns[.]org

Analysis of degaro15sw.duckdns.org indicates a brand impersonation scheme targeting Leboncoin, a classified advertisements platform. The domain, currently offline, was previously active with the page title 'leboncoin - connexion,' directly referencing the brand's login portal. Infrastructure analysis reveals the domain resolved to IP 181.174.164.198, part of the 181.174.164.0/22 range assigned to AS52469 (Offshore Racks S.A.), a hosting provider based in Panama. No SSL certificate was detected, increasing the likelihood of unencrypted credential harvesting. The domain lacks configured nameservers, a common trait in short-lived phishing setups.

Security vendor detection on July 23, 2026, shows 13 of 95 engines flagged the domain, though the absence of further context limits attribution to specific malware families or kits. The domain appears on one security blocklist and is blocked by PhishDestroy, while Scamadviser assigns a trust score of 1/100, reinforcing its malicious classification. DuckDNS, the dynamic DNS provider, is frequently exploited for phishing due to its low-cost, ephemeral subdomains, though no evidence suggests abuse of DuckDNS itself in this case. Defenders should treat this domain as high-risk for credential theft targeting Leboncoin users.

The lack of SSL, offshore hosting, and blocklist presence are concrete indicators of malicious intent. While the domain is offline, monitoring for re-emergence under the same or similar subdomains (e.g., variations of 'degaro' or 'leboncoin') is recommended. No evidence links this domain to broader campaigns or specific threat actors, and the exact content of the phishing page remains unanalyzed. Organizations should update web filters and endpoint protection to block the domain and its resolved IP, and consider proactive takedowns if the domain reactivates.