duyenbt[.]com

Analysis of duyenbt.com confirms it as an active credential-phishing domain targeting email and Facebook account credentials. The domain, registered on May 16, 2026, through Squarespace Domains II LLC, currently resolves to IP 172.96.185.69 (Hawk Host Inc, Hong Kong) and returns an HTTP 302 redirect, suggesting dynamic routing to evade detection. The page title, 'SELLALLMAIL.COM - Sell All Mail - Email Khôi Phục - FB Dangtuyenhuan,' explicitly advertises the sale of recovered email accounts and Facebook credentials, indicating a secondary market for compromised data rather than direct phishing lures. Infrastructure analysis reveals the domain uses Google Cloud nameservers (ns-cloud-b1.googledomains.com and others) and a Let's Encrypt SSL certificate (R13), providing a veneer of legitimacy while obscuring malicious intent. The domain appears on one security blocklist and is flagged by Google Safe Browsing for social engineering. AlienVault OTX lists it in a threat intelligence pulse, and 18 of 92 security vendors on VirusTotal detect it as malicious, though the specific phishing kit or obfuscation techniques remain unconfirmed. Defenders should treat duyenbt.com as a high-risk domain due to its direct association with credential trafficking. Blocking the domain and its resolving IP (172.96.185.69) at perimeter controls is recommended. Further investigation into linked infrastructure (e.g., redirect chains, associated IPs) may uncover additional compromised accounts or phishing campaigns. The domain's recent registration and active status suggest it remains operational, warranting continuous monitoring for shifts in hosting or naming patterns.