h2[.]sdvu[.]click

This domain, h2.sdvu.click, was registered on August 30, 2025, through Sav.com, LLC, and is associated with phishing activity targeting unspecified brands or services. Infrastructure analysis reveals Cloudflare nameservers (augustus.ns.cloudflare.com, laura.ns.cloudflare.com) and resolution to a Netherlands-based IP, 178.16.53.103, hosted on AS202412 (Omegatech LTD). The domain lacks an SSL certificate, increasing the likelihood of unencrypted credential harvesting or malware distribution. At the time of assessment, the domain displayed a default placeholder page with the title 'Site is created successfully!', indicating either a recently deployed or abandoned phishing infrastructure.

Detection data from July 2026 shows 15 of 93 security vendors on VirusTotal flagged the domain as malicious, while PhishDestroy and at least one other security blocklist have actively blocked it. The domain was taken offline prior to analysis, limiting further forensic examination of its intended payload or target. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk.

Defenders should treat this domain as part of a broader phishing campaign, particularly given its use of Cloudflare for potential anonymization and the absence of legitimate content. Network-level blocking is recommended for any residual resolution attempts, and retrospective log analysis should be conducted to identify prior interactions with this domain. No specific phishing kit or targeted brand was identified in the available data.