p2[.]aurhma[.]info

The domain p2.aurhma.info was registered through Sav.com, LLC on September 23, 2025 and is currently listed as offline. DNS resolution points to the single IPv4 address 178.16.53.103, which belongs to the NL‑based network AS202412 owned by Omegatech LTD. The domain uses Cloudflare’s authoritative nameservers augustus.ns.cloudflare.com and laura.ns.cloudflare.com, indicating that the attacker leveraged Cloudflare’s DNS service to hide the true origin of the host. No TLS certificate was observed for the site, meaning all HTTP traffic would have been unencrypted.

The only visible artifact on the web server is the page title "Site is created successfully!", which provides no indication of the intended victim‑facing content. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that it was recognized as malicious by at least one defensive platform. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that eight of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of abuse.

While the exact phishing payload or targeted brand is not disclosed, the combination of a recent registration, low‑reputation score, lack of SSL, and detection by multiple vendors strongly suggests a generic phishing campaign. Uncertainty remains around the specific lures or credential‑stealing mechanisms employed, as the page content has not been publicly captured. Defenders should continue to block p2.aurhma.info at network perimeter and DNS layers, monitor for any resurgence of the domain or related IP addresses, and update threat intelligence feeds to include the observed indicators of compromise. Ongoing observation of the associated IP range (AS202412) is advised, as the attacker may repurpose the host for future campaigns.