auth-code-verif[.]beer

auth-code-verif.beer is currently active and resolves to the IPv4 address 178.16.52.101, which is registered to Omegatech LTD in Germany. The domain was registered through Dynadot Inc and is served through Cloudflare’s infrastructure, using the nameservers irena.ns.cloudflare.com and noel.ns.cloudflare.com. A Let’s Encrypt certificate (YR1) is present, but the web server returns a 403 Forbidden status, indicating that the site is deliberately restricting access. VirusTotal has recorded 19 detections out of 91 security vendors, and the domain appears on three public blocklists. It is also referenced in a single AlienVault OTX pulse and is blocked by the phishing‑filtering services PhishDestroy, MetaMask, and SEAL. The combination of recent registration, German hosting, Cloudflare front‑end, and multiple vendor detections suggests an active phishing infrastructure, although the exact payload or impersonated brand has not been disclosed. Defenders should add 178.16.52.101 and auth-code-verif.beer to network blocklists, monitor DNS queries for the domain, and enforce URL filtering for any traffic to the host. Continuous threat‑intel feeds should be consulted for updates, as further malicious activity may be observed.