chnsaulins[.]duckdns[.]org

The domain chnsaulins.duckdns.org has been identified as a high-risk phishing site targeting users of Crédit Agricole. No specific drainer kit has been detected, but the threat poses significant risk to financial data compromise.

Analysis indicates that the domain has a VirusTotal score of 21/95, suggesting a moderate level of detection by security vendors. The domain is registered through DuckDNS and resolves to the IP address 64.89.160.102, which is located in Luxembourg (LU) under AS205759 Ghosty Networks LLC. The domain was created on March 10, 2026, and has been flagged by Google Safe Browsing as a phishing site. It also appears on 1 security blocklist, further corroborating its malicious nature.

The domain is currently offline, which suggests that it may have been taken down as part of a response action to mitigate the threat. Despite the domain being offline, the infrastructure and any remaining traces could still pose a risk. Organizations and individuals are advised to remain vigilant and monitor for any resurgence of the domain or similar phishing sites targeting Crédit Agricole. Additional measures such as updating security configurations and educating users about phishing tactics can help in preventing future attacks.