h2[.]auloax[.]live

The domain h2.auloax.live was registered on August 30, 2025 through Sav.com, LLC and resolves to the IPv4 address 178.16.53.103, which is allocated to AS202412 (Omegatech LTD) in the Netherlands. The domain is hosted on Cloudflare’s DNS infrastructure, using the nameservers augustus.ns.cloudflare.com and laura.ns.cloudflare.com. No TLS certificate is presented; the site operates without HTTPS, which is consistent with many low‑cost phishing deployments. The HTTP response returned the title "Site is created successfully!" indicating a placeholder page rather than a targeted brand landing page. Security telemetry shows the domain appears on one public blocklist and is explicitly listed by PhishDestroy.

Google Safe Browsing flags it for social engineering, and VirusTotal reports that 15 of 93 scanned scanners flag the domain as malicious, reinforcing the suspicion of phishing use. Gridinsoft assigns a trust score of 0 / 100, underscoring the lack of reputation. The site has been taken offline at the time of analysis, but historical data confirms its malicious status. Analysts can confirm the presence of a generic phishing infrastructure: the combination of a newly created domain, lack of SSL, low trust score, and multiple vendor detections points to a high‑risk credential‑harvesting operation.

However, the exact target brand or phishing kit employed remains unknown because no brand name appears in the page title or other provided artifacts. Consequently, defenders should treat the domain as a high‑confidence phishing indicator. Recommended actions include adding the domain and its associated IP to blocklists, updating URL filtering rules, and monitoring for any resurgence of the same nameserver or IP patterns. Continuous re‑scanning of the IP address is advised, as threat actors may reuse the host for other malicious domains.