autohaul-pro[.]com

PhishDestroy identifies autohaul-pro.com as an active generic phishing domain targeting users under the guise of a professional haulage and auto transport service. The domain was registered on March 30, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted on IP 104.21.6.21. It utilizes a Let’s Encrypt SSL certificate to appear legitimate and has attracted zero detections across 95 VirusTotal scanners to date. No specific drainer kit or brand impersonation has been confirmed, suggesting this may be a newly deployed or evolving campaign.

Technical indicators confirm elevated risk despite low detection. The domain shows 4/95 VirusTotal detections, zero Google Safe Browsing (GSB) flags, and is not yet listed on major threat intelligence blocklists. It was registered on March 30, 2026, and resolves to IP 104.21.6.21 via NICENIC INTERNATIONAL GROUP CO., LIMITED. The use of a legitimate SSL certificate indicates an attempt to bypass browser warnings and gain user trust. This low-profile deployment strategy is typical of opportunistic phishing operations seeking to exploit trust in professional services.

As of analysis, autohaul-pro.com remains active and under investigation with a risk level marked as under_investigation. Security teams have flagged the domain but no takedown or block has been enforced yet. Users are advised to avoid interacting with the site, especially any forms requesting personal, financial, or shipping information. Blocking the domain and IP at the network level is recommended. Remaining risk is moderate due to zero detections and active hosting, emphasizing the need for rapid threat intelligence sharing and proactive user education.