habyqaovo[.]autos

Analysis on habyqaovo.autos, reported 19 July 2026, identifies the domain as an active generic phishing infrastructure with a high risk rating. The zone is hosted on Cloudflare, using nameservers ariadne.ns.cloudflare.com and chip.ns.cloudflare.com, and resolves to IP 172.67.163.42, which is geolocated to Canada and attributed to Cloudflare, Inc. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS chain but offering no legitimacy to the underlying content. VirusTotal scans show three of ninety‑one security vendors flag the domain, and the site returns HTTP 403 responses, suggesting restricted or conditional content delivery. The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy. Registration was performed through NameCheap, Inc., with no further registrar details disclosed. While the page title “Just a moment…” is currently the only visible content indicator, no additional page analysis is available. Defenders should block DNS resolution for habyqaovo.autos, add the IP 172.67.163.42 to network deny lists, and monitor for any related Cloudflare‑hosted endpoints. Continuous re‑scanning on VirusTotal and integration of threat intel feeds are recommended to capture any changes in detection status or additional malicious indicators.