paie-lebon.duckdns.org
Kategoria: Phishing
Aby korzystać z produktu z pełną funkcjonalnością, musisz kupić licencję na Combo Cleaner. Dostępny jest ograniczony siedmiodniowy bezpłatny okres próbny. Combo Cleaner należy do RCS LT i jest obsługiwany przez tę firmę, spółkę macierzystą PCRisk.com.
Opis paie-lebon.duckdns.org
This domain appears to host a login page styled to resemble Leboncoin, a well-known French classifieds marketplace. The page title, visible branding, and screenshot indicate that it is presenting a "leboncoin - connexion" interface and prompting visitors to enter an email address and password.
The domain itself is a DuckDNS subdomain rather than an official Leboncoin web property, which suggests it may not be operated by the legitimate marketplace. The page also loads assets from a separate web.app host, indicating a lightweight externally hosted front-end rather than a standard corporate login deployment. Based on the available content and classifications, the site appears to be intended to collect account credentials rather than provide an independent service.
Ocena bezpieczeństwa paie-lebon.duckdns.org
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 18 out of 91 security engines, and several web-classification providers categorized it as phishing or fraud-related. The screenshot further shows a login form closely imitating Leboncoin branding while being hosted on an unrelated DuckDNS subdomain, which may be consistent with credential-harvesting activity.
Although one malware scan reported no malicious files and several blacklist sources were clean, those findings do not outweigh the broader phishing consensus in this case. The combination of strong multi-engine detection, a very low trust score, and branding that appears to mimic a known service on a non-official domain materially increases concern.
Based on these findings, this website may pose potential risks to visitors.
Opis techniczny
The site was reachable over HTTPS with a valid Let's Encrypt certificate, hosted on an Apache server at IP address 64.89.160.102 in Luxembourg. The domain uses DuckDNS nameservers, is relatively old as a parent hostname, and has DNSSEC disabled (unsigned). A valid certificate should not be treated as proof of legitimacy, since low-cost certificates are commonly used by both legitimate and abusive sites.
The page appears technically simple, with only one scanned file and several external assets loaded from flowering-pen.web.app. No flagged files or iframes were reported in the provided malware scan, but the use of third-party hosted assets alongside a brand-mimicking login page may still be a concern from an impersonation and credential-security perspective.
Podziel się swoimi doświadczeniami z tą witryną. Czy była bezpieczna? Czy wystąpiły jakieś problemy?