onesourcedists[.]com

Analysis of onesourcedists.com indicates it was registered on March 05, 2026 through Wild West Domains, LLC. The domain resolves to IP 167.88.168.129, which is assigned to AS14956 RouterHosting LLC in the United States. The hosting provider operates a Microsoft Online nameserver pair (ns1.bdm.microsoftonline.com, ns2.bdm.microsoftonline.com), a configuration often observed in compromised or malicious infrastructure. The site served a HTTP 403 Forbidden response and presented a page title of "403 Forbidden", suggesting the content is not publicly reachable at the time of collection. An SSL certificate issued by Let’s Encrypt (certificate identifier E8) was present, indicating the site used HTTPS but offers no additional trust.

VirusTotal records show that 16 of 94 scanned security vendors flagged the domain, confirming a consensus of malicious intent. The domain is listed on at least one external blocklist and has been actively blocked by PhishDestroy. Current operational status is offline, which may be the result of takedown actions or temporary hosting changes. Evidence links are not provided in the source data.

Uncertainty remains regarding the specific phishing payload, targeted brand, or credential‑harvesting mechanisms because no page content beyond the 403 title is available. Defenders should add the domain and its IP address to internal blocklists, monitor DNS queries for the associated nameservers, and continue to watch for re‑registration or reuse of the same hosting infrastructure. Given the multi‑vendor detection and blocklist presence, the domain should be treated as high‑confidence malicious and excluded from user access policies.