swispass1[.]duckdns[.]org

This domain, swispass1.duckdns.org, was observed hosting a credential phishing campaign. The domain is registered with the free dynamic DNS service DuckDNS, which provides no WHOIS details beyond the registrar name. HTTP probing returned a 403 Forbidden status, indicating that the web server is actively denying unauthenticated requests. The server software identified as Nginx, and no SSL certificate was presented, confirming that the site operated only over plain HTTP. The host resolves to the IPv4 address 109.71.253.140, an address allocated to a German entity listed as Rene Roeth trading as ROETH & BECK GbR.

The IP appears on a single security blocklist and has been flagged by PhishDestroy, confirming that the infrastructure is already known to threat‑mitigation services. Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0/100, and Scamadviser assigns 1/100, reflecting a high likelihood of malicious intent. VirusTotal analysis shows that 13 out of 94 scanned security vendors flagged the domain, reinforcing the suspicion of abuse. Nameserver information could not be resolved (NS_NOT_FOUND), which is typical for dynamically managed DNS records and further hampers attribution.

The observable evidence indicates that the domain was used to collect credentials, but the exact phishing kit, targeted brand, or victim profile cannot be confirmed because the landing page content was not retrieved beyond the 403 response. Defenders should block the domain and its associated IP at network perimeter devices, update URL filtering lists with the observed indicator, and monitor for any outbound connections to the IP address. Because the domain is currently offline, ongoing surveillance is recommended to detect any re‑registration or reuse of the same IP range. Additional investigation should focus on the hosting environment of the IP address and any related subdomains that may share the same infrastructure.