auo-24[.]social

Analysis of the domain auo-24.social indicates active credential phishing infrastructure. Registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to IP address 104.21.72.138 and is hosted behind Cloudflare, utilizing HTTP/3 and AngularJS for frontend delivery. The page title 'Seller' suggests a focus on transactional or marketplace-themed deception, though the exact brand or service being impersonated remains unconfirmed due to lack of detailed content analysis. Detection metrics reveal moderate but consistent flagging: six security vendors on a widely used aggregation platform identify the domain as malicious, while two independent blocklists (including PhishDestroy and BLP-Malware) have added it to their denylists. AlienVault OTX records the domain in 14 threat intelligence pulses, indicating recurring inclusion in phishing campaigns. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious sites, and does not mitigate the threat. Infrastructure analysis reveals use of jsDelivr, a content delivery network often exploited to load obfuscated scripts or phishing kits. The domain's creation date, less than a month prior to this report, aligns with typical phishing domain lifecycles, where rapid deployment and short operational windows are standard. Gridinsoft assigns a trust score of 0/100, further corroborating malicious classification. Defenders should treat this domain as high-risk. Block resolution at the network level, particularly to 104.21.72.138, and monitor for related subdomains or newly registered lookalike domains under the same registrar. While the specific phishing kit or targeted brand is not yet identified, the combination of detection volume, hosting infrastructure, and recent registration strongly supports active credential harvesting. Further analysis of intercepted payloads or user reports may clarify the exact deception mechanism.