bbva-pagos[.]duckdns[.]org

Analysis indicates that the domain bbva-pagos.duckdns.org is actively engaged in phishing operations targeting BBVA customers as of July 20, 2026. Infrastructure review reveals the domain is registered through DuckDNS, a dynamic DNS provider frequently exploited for malicious campaigns due to its low barrier to entry and lack of stringent registration requirements. The domain resolves to the IP address 46.151.182.226, though no autonomous system number (ASN) or geolocation data is currently available for further attribution. Nameserver records return NS_NOT_FOUND, suggesting either misconfiguration or deliberate obfuscation of hosting infrastructure. Security vendor detections on VirusTotal show that 17 out of 91 engines flag this domain as malicious, a detection rate consistent with confirmed phishing infrastructure. Google Safe Browsing has classified the domain under social engineering, further corroborating its use in fraudulent activities. The domain is also blocked by PhishDestroy and appears on at least one additional security blocklist, indicating cross-industry recognition of its threat status. No SSL certificate details or HTTP response codes are provided, leaving the exact content and delivery mechanism uncertain; however, the naming convention ('bbva-pagos') strongly suggests an intent to deceive users into believing the site is affiliated with BBVA, a multinational banking institution. Defenders are advised to treat this domain as high-risk and implement immediate blocking measures at the DNS, network, and endpoint levels. Given the use of DuckDNS, which allows rapid domain changes, monitoring for related subdomains or newly registered variants under the same IP range is recommended. Organizations should also alert users to the presence of this phishing domain, particularly those with ties to BBVA or financial services, and encourage reporting of any suspicious communications linking to it.