auth-fort[.]live

Analysis indicates that the domain auth-fort.live remains active as of the report date (July 22, 2026) and is being used for generic phishing operations. The domain was registered on January 17, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, giving it a relatively short lifespan that can help evade legacy reputation filters. It is hosted on Cloudflare infrastructure, resolving to the IP address 172.67.171.36, and the authoritative name servers are barbara.ns.cloudflare.com and braden.ns.cloudflare.com, confirming use of Cloudflare’s DNS service.

VirusTotal scans show that 16 of 95 security vendors have flagged the domain as malicious, indicating moderate consensus among detection engines. The site is listed on one security blocklist and has been explicitly blocked by the PhishDestroy service, demonstrating that at least one specialized anti‑phishing platform has taken mitigation action. No additional public data such as SSL certificate details, HTTP response codes, page title, or associated threat‑intel feeds (e.g., OTX) are present in the current evidence set, so the precise phishing payload, targeted brand, or credential‑harvesting technique cannot be confirmed at this time.

Defenders should add auth-fort.live to domain‑based allow/deny lists and monitor DNS queries for the associated Cloudflare name servers. Because the IP address belongs to a shared Cloudflare edge node, blocking the IP could affect unrelated sites; therefore, DNS‑level blocking of the domain is preferred. Continuous re‑scanning on VirusTotal and periodic checks against blocklist aggregators are recommended to detect any changes in detection posture or additional remediation actions taken by security vendors.