drive-auth-verify[.]com

The domain drive-auth-verify.com is currently active and has been identified as a credential phishing site. Open-source intelligence shows the domain appears on three security blocklists and has been flagged by 12 of 91 security vendors on VirusTotal, indicating a non‑trivial detection rate. DNS resolution points to the Cloudflare‑managed address 104.21.92.76, which geolocates to Canada and is hosted by Cloudflare, Inc. The domain uses a Google Trust Services / WE1 SSL certificate, and HTTP requests return a 303 redirect, a pattern commonly observed in phishing infrastructure. Registration records list Fewmoretaps OU d/b/a Trustname.com as the registrant, and the authoritative nameservers are kolton.ns.cloudflare.com and romina.ns.cloudflare.com. The site is already blocked by threat‑feeds such as PhishDestroy, MetaMask, and SEAL, reinforcing its malicious reputation. While the exact landing page content has not been publicly disclosed, the combination of blocklist presence, vendor detections, and infrastructure characteristics strongly suggests the domain is being used to harvest credentials. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP address, and consider adding the domain to internal deny lists. Ongoing observation is recommended to capture any changes in hosting or certificate details that could indicate a shift in operational tactics.