authenticpodbridge[.]cyou

PhishDestroy identifies a recently activated phishing domain, authenticpodbridge.cyou, leveraging a podcast-themed lure to deceive potential victims. The domain does not impersonate a specific brand but employs a generic phishing approach, suggesting the threat actors may be using a drainer kit designed to harvest credentials or cryptocurrency wallet information. The infrastructure and naming convention imply an attempt to appear legitimate within podcasting or media-related contexts, likely targeting users expecting audio content or related services. This domain was flagged with a VirusTotal detection rate of 2 out of 95 engines as of the latest scan tied to seed 997bf6. It was registered through Dynadot LLC and went live on April 29, 2026. DNS resolution points to IP address 104.21.47.118, which is associated with known malicious activity. The domain currently resides on 2 security blocklists and has been blocked by SEAL and MetaMask. Let’s Encrypt issued an SSL certificate for the domain, which may be used to establish false trust with potential victims. Notably, Google Safe Browsing (GSB) has not yet flagged this domain, indicating a window of opportunity for threat actors before widespread detection. As of this advisory, the domain remains active with a status marked as under_investigation. Immediate response actions have included blocking by SEAL and MetaMask, alongside inclusion on multiple threat intelligence platforms. While the current risk level is classified as under_investigation, the lack of detections by antivirus engines and GSB suggests a developing threat. Users are advised to avoid interacting with this domain and to report any suspicious encounters. Security teams should monitor for related infrastructure and update blocklists accordingly. The remaining risk hinges on the rapid adoption of these countermeasures and the domain’s continued exposure.