h-auth-v6[.]app

On July 24, 2026, the domain h-auth-v6.app was observed to be taken offline. The domain was registered on 21 February 2026 and resolves to the IP address 172.67.204.81, which is owned by Cloudflare, Inc. (ASN 13335) and geolocated in the United States. The TLS certificate presented for the host is identified as “WE1”, indicating a default or automated issuance rather than a brand‑specific certificate. A passive HTTP request returned the page title “Access Denied”, which is consistent with a block page rather than a legitimate login interface.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy filtering service. VirusTotal analysis shows that 2 of 93 scanning engines flagged the domain, corroborating the presence of malicious indicators. No additional intelligence such as a targeted brand, phishing kit, or specific payload was disclosed.

The limited data set prevents a definitive attribution of the phishing campaign’s exact motive or the credential‑harvesting technique employed. Defenders should add h-auth-v6.app to local deny lists, monitor for any future DNS resolutions that point to the same IP range, and consider enforcing stricter outbound traffic controls to Cloudflare edge nodes when anomalous requests are detected. Continuous re‑querying of VirusTotal and blocklist feeds is recommended to capture any changes in detection status should the domain be re‑activated.