discauth2[.]xyz

Analysis of discauth2.xyz shows a high‑risk phishing indicator set against a newly registered infrastructure. The domain was created on April 14, 2026 and is currently active, resolving to the Cloudflare‑hosted address 188.114.96.3 located in Canada. DNS resolution uses Cloudflare name servers dee.ns.cloudflare.com and rocky.ns.cloudflare.com, a pattern often leveraged to hide malicious origins. The site presents an HTTP 403 response and a page title of "Just a moment...", suggesting a possible JavaScript challenge or redirection step commonly employed by phishing operators to evade automated crawlers.

The SSL certificate is issued by Let’s Encrypt (issuer E7), providing a valid TLS handshake but offering no assurance of legitimacy. Reputation checks reveal a Gridinsoft trust score of 0 / 100 and inclusion on the PhishDestroy blocklist, confirming that at least one dedicated anti‑phishing service has cataloged the domain. Additionally, AlienVault OTX reports a single threat‑intel pulse referencing discauth2.xyz, indicating that the domain has been observed in broader community feeds. VirusTotal scans show that four out of ninety‑four security vendors flagged the domain, reinforcing the suspicion of malicious intent despite a modest detection count.

The registrar listed is NICENIC INTERNATIONAL GROUP CO., LIMITED, a known bulk‑registration service that can be abused for rapid domain turnover. Given the convergence of a fresh registration, Cloudflare front‑end, low trust scores, blocklist presence, and multi‑vendor detections, defenders should treat traffic to discauth2.xyz as hostile. Recommended actions include adding the domain to corporate blocklists, configuring web‑proxy filters to drop HTTP requests to the host, monitoring DNS logs for lookups of the domain and its IP, and, where possible, sinkholing the IP address to disrupt any ongoing phishing campaign.