h2[.]auloax[.]click

Analysis indicates that the domain h2.auloax.click was registered through Sav.com, LLC on August 30, 2025. The authoritative nameservers are augustus.ns.cloudflare.com and laura.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS service. DNS resolution points to the IPv4 address 178.16.53.103, which belongs to AS202412 Omegatech LTD and is geolocated in the Netherlands. No TLS certificate was observed, and the site was reported as taken offline at the time of this assessment. The page title returned by the HTTP response is “Site is created successfully!”, which does not reveal any target brand or credential‑collection interface.

VirusTotal scans recorded 13 detections out of 93 security vendors, indicating that a minority of scanners flagged the domain as malicious. The Gridinsoft trust score of 0 / 100 further corroborates a low reputation. PhishDestroy has listed the domain on its blocklist, and the domain appears on one additional security blocklist, reinforcing the classification as a phishing infrastructure. The evidence set demonstrates a typical fast‑flux style deployment: a recently created domain, Cloudflare DNS, a single IP address, and a lack of HTTPS.

While the exact payload or credential‑harvesting page has not been captured, the combination of vendor detections, blocklist listings, and the anomalous page title is sufficient to confirm the domain’s use for generic phishing. Defenders should block both the domain name and its resolved IP address at perimeter firewalls and DNS filters. Continuous monitoring of the associated Cloudflare nameservers is advised to detect any re‑use of the same infrastructure for future campaigns. Additionally, security teams should update threat‑intel feeds with the observed indicators of compromise to improve detection across endpoint and network solutions.