kingautoplex[.]com

Analysis of the domain kingautoplex.com indicates active social media phishing infrastructure as of July 13, 2026. The domain was registered on February 21, 2026, through Wild West Domains, LLC, and currently resolves to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) with a geolocation listed as the United States. The domain is flagged by 6 of 93 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and PhishingDB. AlienVault OTX records the domain in 13 threat intelligence pulses, suggesting recurring malicious activity. The page title, "King AutoPlex - Madison, AL - 256-777-5573 - Used Cars, Used Trucks. Quality Pre-Owned Vehicles," suggests an attempt to impersonate a legitimate automotive dealership, though no direct evidence confirms the specific brand being targeted beyond this generic presentation. The domain employs Cloudflare nameservers (osmar.ns.cloudflare.com, sky.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). Detected technologies include MDBootstrap, Bootstrap, jQuery, Google PageSpeed, Cloudflare Browser Insights, and HTTP/3, which are consistent with modern web infrastructure but do not inherently indicate malicious intent. The domain returns an HTTP 301 redirect, which may be used to forward victims to a secondary malicious endpoint or to obscure the final destination. While the exact phishing mechanism remains unconfirmed, the classification as "social media phishing" implies the domain is likely used to distribute fraudulent links via social platforms, potentially leveraging the automotive dealership theme to deceive users. Defenders should treat this domain as high-risk. Blocking resolution to 188.114.96.3 and monitoring for connections to the domain or its nameservers is recommended. Further analysis of the redirect chain and any associated payloads is advised to determine the full scope of the threat.