mail[.]newemalacessrobln[.]duckdns[.]org

The domain mail.newemalacessrobln.duckdns.org was registered through Gandi SAS and has a creation date of 12 April 2013. DNS resolution points to the IPv4 address 162.241.124.87, which is announced by AS19871 Network Solutions, LLC and geolocated to the United States. The authoritative name servers are ns1.duckdns.org, ns2.duckdns.org and ns3.duckdns.org. No TLS certificate is presented; HTTP connections are served without encryption. The only visible HTML element is a page title of “Default Web Site Page”, indicating that the site is hosted on a generic web server and no further content has been captured.

Security telemetry shows the domain is currently offline, yet it was previously listed on a single public blocklist and is actively blocked by the PhishDestroy sinkhole. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 15 of 93 scanned scanners flagged the host as malicious. The detection ratio suggests a moderate level of confidence among antivirus engines, but the limited number of scanners that observed the site reduces the overall certainty. Analysis confirms that the infrastructure is typical of low‑effort phishing campaigns that rely on dynamic DNS services such as DuckDNS.

The lack of an SSL certificate and the generic page title further point to a placeholder site rather than a fully developed phishing landing page. Because the domain is already taken offline, immediate containment is not required, but defenders should continue to monitor the associated IP address and the three DuckDNS name servers for any re‑activation. Adding the IP 162.241.124.87 and the domain to local block lists, as well as updating URL filtering rules to include the DuckDNS sub‑domain pattern, will help prevent future connections. Continuous observation of VirusTotal and Google Safe Browsing updates is recommended to capture any resurgence of malicious activity.