t-auth[.]cfd

This domain, t-auth.cfd, is classified as an active generic phishing site targeting authentication credentials. Registered on May 6, 2026, through Global Domain Group LLC, it resolves to the IP address 146.103.127.180. The domain is currently flagged by 11 out of 91 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources. It appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, suggesting broad recognition as malicious infrastructure.

Nameservers are hosted on Google Cloud (ns-cloud-c1.googledomains.com and related), which may provide temporary resilience but does not alter the domain's malicious classification. No specific brand or service impersonation has been confirmed in available data, and the exact content of the site remains unanalyzed. However, the domain name (t-auth) implies a focus on authentication or login-themed phishing, a common tactic for credential harvesting.

Defenders should treat this domain as high-risk and prioritize blocking it at DNS, proxy, and endpoint layers. Network logs should be reviewed for connections to 146.103.127.180 or the domain itself, particularly from systems handling sensitive authentication workflows. Given its presence on multiple blocklists and vendor detections, this domain is unlikely to be a false positive and should be handled as confirmed malicious infrastructure.