h1[.]onlineautao[.]ink

The domain h1.onlineautao.ink was registered on August 30, 2025 through Sav.com, LLC and is hosted on the IP address 178.16.53.103, which resolves to the Netherlands under ASN202412 (Omegatech LTD). The site resolves to two Cloudflare nameservers (augustus.ns.cloudflare.com and laura.ns.cloudflare.com) but presents no SSL certificate, leaving the HTTP connection unencrypted. The page title returned by the server is "Site is created successfully!", offering no direct indication of malicious content but confirming that the site is operational when queried. The domain is classified as a brand impersonation campaign targeting the Linea brand, and Google Safe Browsing has flagged it for social engineering.

VirusTotal analysis shows that 17 of 93 security vendors have flagged the domain, indicating a moderate consensus of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on at least one external security blocklist. PhishDestroy has already taken the site offline, and current monitoring confirms the domain is no longer serving content.

While the exact phishing payload or credential‑harvesting page has not been captured, the combination of brand targeting, lack of TLS, low trust score, and multiple vendor detections suggests a high‑risk profile. Defenders should immediately block the domain and its resolving IP at perimeter defenses, add the domain to internal URL filtering lists, and monitor for any related sub‑domains or future registrations under the same registrar or ASN. Continuous re‑scanning of the IP address is advised, as the infrastructure could be reused for subsequent impersonation attempts.