h1[.]olux[.]click

This domain, h1.olux.click, is assessed as a high-risk credential harvesting phishing site. Analysis indicates it was actively used to deceive users into submitting sensitive login information, likely through spoofed authentication portals or fraudulent account verification pages. The infrastructure exhibits multiple red flags consistent with phishing operations, including the absence of encryption and rapid deployment following domain registration. Infrastructure analysis reveals the following technical indicators: the domain was registered on August 30, 2025, through Sav.com, LLC, and resolves to the IP address 178.16.53.103, hosted on AS202412 (Omegatech LTD) in the Netherlands. Security vendors flagged the domain with 17 detections out of 95 on VirusTotal, while Google Safe Browsing classified it as phishing. The page title 'Site is created successfully!' suggests automated or template-based deployment, a common tactic in phishing campaigns. The domain appears on at least one security blocklist and was subsequently taken offline, though residual risk may persist for users who interacted with it prior to deactivation. Mitigation measures should focus on credential security and infrastructure hardening. Organizations should immediately block the domain and its associated IP (178.16.53.103) at the network level, including DNS and proxy filters. Users who may have entered credentials on this site should reset passwords for all accounts where the same credentials were reused, prioritizing email, financial, and administrative access. Multi-factor authentication (MFA) should be enforced for all critical accounts to mitigate the impact of stolen credentials. Security teams should monitor for follow-up phishing attempts using similar domains or IPs within the same hosting provider (AS202412), as threat actors often reuse infrastructure across campaigns.