bdgdhsgj[.]duckdns[.]org

Analysis date: July 23, 2026. The domain bdgdhsgj.duckdns.org is currently active and hosts a web page whose title is “HSBC — Login”. The page title, combined with the explicit indication that the site impersonates HSBC, confirms a banking‑phishing campaign targeting customers of the global bank. The domain resolves to the IPv4 address 107.175.95.129, which belongs to the AS36352 HostPapa network located in the United States. Registration information shows the domain was created on April 12, 2013 and was registered through Gandi SAS.

The authoritative name servers are ns1.duckdns.org, ns2.duckdns.org and ns3.duckdns.org, consistent with the DuckDNS dynamic DNS service. Transport‑layer security is provided by a Let's Encrypt certificate (R12), indicating that the site presents a valid TLS handshake despite its malicious purpose. HTTP requests receive a 302 redirect response, a common technique used to forward victims to credential‑harvesting pages. Reputation testing shows a Gridinsoft trust score of 0 out of 100, and the domain is listed on one external blocklist. The phishing‑specific blocklist PhishDestroy has already flagged the domain, and VirusTotal analysis reports that 12 of 95 security vendors have identified the domain as malicious.

The available evidence points to a classic banking‑phishing infrastructure that leverages free dynamic DNS, low‑cost hosting, and publicly trusted TLS certificates to increase credibility. Because the domain has been active for several years, defenders should continue to monitor resolution changes and consider adding the domain and its IP address to deny‑list rules at firewalls, DNS filters, and endpoint protection platforms. Organizations should also enable URL filtering that references the PhishDestroy and other blocklists, and educate users that any unsolicited request to log in to HSBC that originates from a duckdns.org subdomain is likely fraudulent.