dur[.]descon-ae[.]com

Analysis of dur.descon-ae.com indicates a confirmed credential-theft phishing infrastructure, currently offline but previously active under Cloudflare hosting. The domain was registered on August 11, 2025, through Name SRS AB and resolved to 172.67.162.56, an IP address assigned to Cloudflare, Inc. (AS13335). No SSL certificate was present, increasing the risk of plaintext credential interception. The page title 'Welcome Back' suggests a login portal, though the exact target brand or service remains unconfirmed due to lack of visual analysis.

Detection coverage is significant: 14 of 95 security vendors on VirusTotal flagged the domain, and it appears on at least one security blocklist, specifically PhishDestroy. Scamadviser and Gridinsoft both assigned trust scores of 1/100 and 0/100, respectively, further corroborating malicious classification. Nameservers lars.ns.cloudflare.com and ullis.ns.cloudflare.com are consistent with Cloudflare proxy usage, a common tactic to obscure origin servers. Defenders should treat this domain as a confirmed phishing threat, particularly for credential harvesting.

While the site is currently offline, the infrastructure may resurface under the same or similar domains. Recommended actions include blocking the domain and IP at network perimeter controls, monitoring for related subdomains or newly registered lookalike domains, and reviewing logs for connections to 172.67.162.56 or the Cloudflare ASN. The absence of SSL and the use of a recently registered domain with no legitimate history are strong indicators of malicious intent.