sexsoldier[.]duckdns[.]org

The domain sexsoldier.duckdns.org is identified as a high-risk brand impersonation threat targeting Steam, a digital distribution platform. Analysis confirms the domain hosted a fake login page titled 'Sign In,' designed to harvest user credentials. The domain is currently offline, but prior activity aligns with credential theft campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gandi SAS and resolved to the IP address 62.60.226.105, located in Germany under AS214351 (FEMO IT SOLUTIONS LIMITED). Security vendors flagged the domain as malicious, with 21 out of 95 VirusTotal engines detecting it as phishing. Google Safe Browsing also classified it as a phishing threat, and it appeared on one security blocklist. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains due to its accessibility. The domain has been taken offline, likely due to detection and mitigation efforts. However, similar infrastructure may reappear under different subdomains or IPs. Organizations and users are advised to block the domain and its associated IP at the network level, monitor for credential reuse attempts, and implement multi-factor authentication (MFA) for Steam accounts. Security teams should review logs for connections to 62.60.226.105 or related AS214351 infrastructure and update detection rules to include DuckDNS-based phishing domains targeting gaming platforms.