auth-sceneunlock[.]com

Analysis of auth-sceneunlock.com indicates this domain is actively involved in credential-phishing campaigns as of July 29, 2026. The domain was registered on June 12, 2026, through Wix.com Ltd., a registrar frequently utilized for both legitimate and malicious sites. Infrastructure analysis reveals the domain resolves to the IP address 91.92.66.188, though further details about the hosting provider or autonomous system number are not currently available. Detection data from security vendors shows that 6 out of 91 engines on VirusTotal have flagged this domain, suggesting moderate but not universal recognition of its malicious nature.

Additionally, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specifically target phishing and fraudulent sites. The exact content or targeted brand of the phishing page is not yet confirmed, as no page title, kit identification, or brand target has been provided in available intelligence. However, the domain name itself includes terms like 'auth' and 'unlock,' which are commonly associated with credential-harvesting schemes. Defenders should treat this domain as an active threat, particularly in environments where user authentication or sensitive data access is critical.

Network-level blocking is recommended for the domain and its associated IP address. If internal logs show connections to auth-sceneunlock.com, immediate investigation for potential credential compromise or unauthorized access attempts is advised. Given the domain's recent registration and presence on multiple blocklists, continued monitoring for changes in infrastructure or detection status is warranted.