42g648[.]com

Analysis of 42g648.com indicates that the domain is actively being used for generic phishing operations. The domain was created on September 27, 2024 and remains live as of the report date, July 22, 2026. Registration was performed through Gname.com Pte. Ltd., a registrar known to host both legitimate and malicious sites. DNS resolution points to the IP address 172.65.235.97, which is currently reachable and therefore capable of serving malicious content.

The authoritative nameservers are a.share-dns.com, b.share-dns.net, ns1.gname-dns.com, and ns2.gname-dns.com, a configuration that is typical for domains hosted on shared DNS services. VirusTotal has processed the domain with 95 scanning engines, none of which have raised a detection at the time of analysis; this lack of detections does not constitute a safety guarantee, but it does mean that no known signatures have triggered on the domain yet. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy collective, confirming that at least one threat‑intelligence community has identified it as malicious.

No public information is available regarding SSL certificate details, HTTP response codes, Safe Browsing status, OTX mentions, or page title content, leaving those aspects of the infrastructure unverified. Defenders should add 42g648.com to their deny‑list rules, monitor DNS queries for the listed nameservers, and consider blocking traffic to the associated IP address. Continuous re‑evaluation is advised, as the lack of detections may change if the threat actors modify payloads or if additional scanning engines acquire signatures.