distribuidoraquiabsa[.]com

On July 25, 2026 threat intelligence analysts observed that the domain distribuidoraquiabsa.com is currently offline but exhibits multiple indicators of a generic phishing infrastructure targeting the Australian government portal myGov. The site previously served a page with the title “Sign in with myGov – myGov”, suggesting an attempt to harvest credentials. Registration data shows the domain was created on July 12, 2021 and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers are nspro18.hostgator.mx and nspro19.hostgator.mx, both associated with the HostGator hosting platform. DNS resolution points to the IPv4 address 162.241.61.49, which belongs to AS19871 Network Solutions, LLC and is geolocated in the United States.

An SSL certificate issued by Let’s Encrypt (R12) was present, indicating the use of a free, automated certificate to enable HTTPS. HTTP probing returned a 503 Service Unavailable response, consistent with a temporary takedown or removal of malicious content. VirusTotal scans recorded 12 positive detections out of 93 submitted security vendors, and the domain appears on a single security blocklist. Additionally, the anti‑phishing service PhishDestroy has listed the domain as blocked. Mail exchange is defined as mail.distribuidoraquiabsa.com with priority 0, although no further mail testing is available.

The combination of a targeted page title, legitimate‑looking TLS certificate, and a modest detection count indicates a low‑to‑moderate level of operational sophistication, but the limited visibility on blocklists and the recent offline status reduce immediate exposure. Uncertainties remain regarding the current hosting environment, the presence of any active command‑and‑control channels, and whether additional phishing clones have been deployed under the same infrastructure. Defenders should continue to monitor the domain’s IP address and associated hostnames, enforce blocklisting of 162.241.61.