sliconsltas[.]duckdns[.]org

Analysis of sliconsltas.duckdns.org as of August 05, 2026 indicates that the domain is actively used in a generic phishing campaign and is classified as high risk. The domain is hosted on the free dynamic DNS service DuckDNS, which often lacks stringent verification, and resolves to the IPv4 address 69.169.97.191. No authoritative nameserver records were returned (NS_NOT_FOUND), limiting visibility into the underlying DNS configuration. Ten‑plus security engines on VirusTotal have identified the domain as malicious, with 12 of 91 vendors flagging it.

Independent phishing feed aggregators PhishDestroy and OpenPhish have already added the domain to their blocklists, and the domain appears on two additional security blocklists. These multiple detections suggest a coordinated effort to distribute credential‑stealing pages, although the exact landing page content, SSL/TLS deployment, and targeted brands have not been publicly disclosed. Defenders should immediately block both the domain name and the resolved IP address at network perimeter and DNS filtering layers.

Continuous monitoring of outbound connections to 69.169.97.191 is advised, and any internal traffic to the domain should be logged and investigated. Given the lack of further telemetry, threat hunters should treat any related indicators as suspicious and prioritize correlation with credential‑theft incidents. Ongoing re‑evaluation is recommended as additional intelligence becomes available.