paie-lebon.duckdns.org
Catégorie : Phishing
Pour utiliser le produit avec toutes ses fonctionnalités, vous devez acheter une licence pour Combo Cleaner. Essai gratuit limité à sept jours. Combo Cleaner appartient à et est exploité par RCS LT, la société mère de PCRisk.com.
Description de paie-lebon.duckdns.org
This domain appears to host a login page styled to resemble Leboncoin, a well-known French classifieds marketplace. The page title, visible branding, and screenshot indicate that it is presenting a "leboncoin - connexion" interface and prompting visitors to enter an email address and password.
The domain itself is a DuckDNS subdomain rather than an official Leboncoin web property, which suggests it may not be operated by the legitimate marketplace. The page also loads assets from a separate web.app host, indicating a lightweight externally hosted front-end rather than a standard corporate login deployment. Based on the available content and classifications, the site appears to be intended to collect account credentials rather than provide an independent service.
Évaluation de sécurité de paie-lebon.duckdns.org
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 18 out of 91 security engines, and several web-classification providers categorized it as phishing or fraud-related. The screenshot further shows a login form closely imitating Leboncoin branding while being hosted on an unrelated DuckDNS subdomain, which may be consistent with credential-harvesting activity.
Although one malware scan reported no malicious files and several blacklist sources were clean, those findings do not outweigh the broader phishing consensus in this case. The combination of strong multi-engine detection, a very low trust score, and branding that appears to mimic a known service on a non-official domain materially increases concern.
Based on these findings, this website may pose potential risks to visitors.
Description technique
The site was reachable over HTTPS with a valid Let's Encrypt certificate, hosted on an Apache server at IP address 64.89.160.102 in Luxembourg. The domain uses DuckDNS nameservers, is relatively old as a parent hostname, and has DNSSEC disabled (unsigned). A valid certificate should not be treated as proof of legitimacy, since low-cost certificates are commonly used by both legitimate and abusive sites.
The page appears technically simple, with only one scanned file and several external assets loaded from flowering-pen.web.app. No flagged files or iframes were reported in the provided malware scan, but the use of third-party hosted assets alongside a brand-mimicking login page may still be a concern from an impersonation and credential-security perspective.
Partagez votre expérience avec ce site web. Était-il sûr ? Avez-vous rencontré des problèmes ?