jastorkast[.]duckdns[.]org

Analysis of the subdomain jastorkast.duckdns.org shows a short‑lived infrastructure typical of opportunistic phishing campaigns. The domain was created on 3 March 2026 and is registered through the free dynamic DNS service DuckDNS, a provider frequently abused for disposable malicious sites. DNS resolution points to the IPv4 address 94.103.173.144, which resides in Germany and is announced by ASN 44486 (synlinq.de). The web server identified on this host is Nginx, serving only HTTP; no TLS certificate was presented, confirming the absence of encrypted transport.

An HTTP request to the site returned the page title "Zugriff verweigert", indicating that the server is configured to deny access or that the content has been removed. Security telemetry shows a Gridinsoft trust score of 0 / 100, the lowest possible rating, and the domain is currently blocked by the PhishDestroy sink‑hole service. It appears on a single public blocklist and has been flagged by 12 of 94 antivirus and URL‑reputation engines on VirusTotal, reinforcing the suspicion of malicious intent. At the time of this report the site is offline, limiting immediate observation of payloads or credential‑harvesting pages.

The lack of SSL, the generic page title, and the reliance on a free DNS provider leave open questions about the exact phishing lure and target audience. Defenders should proactively block both the domain and its resolved IP address, monitor for other DuckDNS subdomains that resolve to the same ASN, and incorporate the observed indicators—IP, ASN, Nginx fingerprint, and trust‑score rating—into intrusion‑detection rules. Continuous review of threat‑intel feeds for new detections related to this host is recommended, as the infrastructure could be re‑activated under a different subdomain in the future.