001122102120[.]duckdns[.]org

Analysis indicates that the subdomain 001122102120.duckdns.org is currently offline but has been identified as a generic phishing host. The domain resolves to IP 192.169.69.26, which HYAS data attributes to Canada. Registration information shows the subdomain was created on 12 April 2013 and was registered through Gandi SAS, using the standard DuckDNS nameservers ns1.duckdns.org, ns2.duckdns.org, and ns3.duckdns.org. The page title retrieved from prior scans is “www.001122102120.duckdns.org”, providing no additional context about the targeted brand or payload.

VirusTotal reports that 16 of 93 scanning engines flagged the domain, confirming malicious intent. The domain appears on one external blocklist and is actively blocked by the PhishDestroy service. No additional intelligence such as SSL certificates, HTTP response codes, Safe Browsing status, or OTX references is available in the current dataset. The lack of visible content means the exact phishing vector, credential‑stealing pages, or targeted victims remain unknown.

Defenders should continue to deny resolution to this host at the network perimeter, add the IP address 192.169.69.26 to deny‑list rules, and monitor the DuckDNS namespace for re‑use of the subdomain or similar patterns. Periodic re‑resolution checks are recommended to detect any future activation. Because the registrar is Gandi SAS, investigators may request registration records if deeper attribution is required. In the absence of active content, the primary mitigation focus is on blocking and monitoring the associated infrastructure.