1217[.]cc

PhishDestroy first observed 1217.cc on Feb 26, 2026. The captured page title is “Clock error”. Current evidence score: 96/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, Enkrypt, DNS security resolvers, and URLQuery. VirusTotal recorded 12 detections among 93 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, G-Data, Kaspersky, Lionic, Seclookup, Sophos on Jul 10, 2026 at 15:05 UTC. Enkrypt listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 22:20 UTC. DNS security checks returned 3 blocking results across 14 tested policies: Control D Adblock, Control D Family, Control D Malware; no observation timestamp was retained. URLQuery recorded 3 threat-system alerts on Nov 9, 2025 at 23:10 UTC. Non-positive and contextual checks: AlienVault OTX listed 1 community pulse reference (not vendor detections) on Mar 1, 2026 at 01:07 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:53 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:50 UTC.

HTTP 301 was recorded on Aug 7, 2026 at 22:14 UTC. Registration records for the domain list GoDaddy.com, LLC as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 2405:1c0:6611:678:b7fb:f75d:91:118 on AS55547 (WOODSNET-PH Unit D,E,F,G 28th Floor, PH). The IP and ASN identify shared CDN edge infrastructure; the origin server is not established by this address. The stored server header is CK6u06Vu4. DOM analysis on Jul 9, 2026 at 02:21 UTC returned 93/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists sslTrus / sslTrus (RSA) DV CA as the certificate issuer; checked Mar 15, 2026 at 08:10 UTC.

The content indicators and 4 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.