distribution-48[.]com

Analysis indicates that distribution-48.com is currently active as a generic phishing infrastructure. The domain was registered on February 21, 2026 through GMO Internet Group, Inc. d/b/a Onamae.com and resolves to the IPv6 address 2606:4700:3033::6815:1eb0, which is associated with Cloudflare, Inc. (AS13335) in the United States. HTTP traffic returns a 302 redirect while the page title reported by scanners is "403 Forbidden," suggesting that the site may be redirecting visitors to a payload or taking down the front‑end after a detection.

The server stack is identified as Nginx with OpenResty, and the TLS certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority – G2. Reputation checks show a Gridinsoft trust score of 0 out of 100, indicating an extremely low trust rating. The domain appears on five independent security blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple threat intelligence feeds have flagged it.

VirusTotal scans report that three of ninety‑five security vendors have flagged the domain, reinforcing the suspicion of malicious use. Defenders should immediately block the domain at perimeter firewalls and DNS resolvers, enforce TLS inspection to capture the redirect behavior, and monitor for any outbound connections to the associated Cloudflare IP range. Continuous re‑evaluation is advised, as the underlying hosting provider may change the IP address without notice, and the low trust score suggests that additional malicious payloads could be deployed in the future.