app[.]distribution-flr[.]xyz

The domain app.distribution-flr.xyz is currently active and has been classified as a generic phishing site with an elevated risk rating. VirusTotal scans indicate that 2 of 91 security vendors have flagged the domain as malicious. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy filtering service.

No public registrar, hosting IP, SSL certificate, Safe Browsing, or additional threat‑intel details have been published, so the broader infrastructure behind the campaign remains unknown. The limited evidence suggests a focused phishing operation, but the lack of further technical artifacts prevents a complete attribution. Security teams should add app.distribution-flr.xyz to DNS and web proxy blocklists, enforce strict outbound filtering, and monitor for any related command‑and‑control traffic.

Sharing the indicator with internal and industry ISACs will improve collective detection capability. Continuous re‑evaluation is advised as new intelligence may emerge.