p2[.]webauloax[.]live

Analysis of the domain p2.webauloax.live indicates elevated-risk phishing infrastructure active as of July 23, 2026. The domain was registered on August 30, 2025, through Sav.com, LLC, and currently resolves to the IP address 178.16.53.103, hosted on AS202412 (Omegatech LTD) in the Netherlands. No SSL certificate is present, increasing the likelihood of unencrypted credential interception. The domain uses Cloudflare nameservers (augustus.ns.cloudflare.com and laura.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns.

The page title, 'Site is created successfully!', suggests either a placeholder or a recently deployed phishing kit, though the exact content and target brand remain unconfirmed. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist, specifically PhishDestroy. VirusTotal reports 13 detections out of 93 vendors, though this does not confirm the absence of additional malicious activity. The domain is currently offline, which may indicate a temporary takedown or a pause in operations.

Defenders should treat this domain as high-risk for phishing campaigns, particularly given its Cloudflare-backed infrastructure and lack of SSL. Network-level blocking of 178.16.53.103 and monitoring for related subdomains under webauloax.live is recommended. If internal logs show connections to this domain, immediate credential reset and endpoint analysis are advised. Further investigation into the hosting provider (Omegatech LTD) may reveal additional linked malicious domains.