auth[.]mobivers[.]top

Analysis of auth.mobivers.top shows a short-lived domain created on February 21, 2026 that was subsequently taken offline. The domain resolves to the IP address 172.67.157.126, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. An SSL certificate identified as "WE1" is present, indicating that the site was served over HTTPS before being removed. The HTTP response returns a generic "404 Not Found" title, providing no content for further inspection.

Reputation services have flagged the domain: it appears on a single security blocklist and is listed by the PhishDestroy blocklist. Gridinsoft assigns a trust score of zero out of one hundred, and VirusTotal reports that 14 out of 93 scanning engines have marked the domain as malicious. The combined evidence points to a generic phishing operation that was quickly decommissioned.

Uncertainty remains regarding the specific phishing campaign payload or target brand, as no page content or lure details have been captured. Defensive recommendations include adding auth.mobivers.top to deny lists at perimeter and DNS filtering layers, monitoring traffic to the associated Cloudflare IP for any residual activity, and reviewing any recent logs for connections to that address. Given the low trust score and multiple vendor detections, organisations should treat the domain as hostile and enforce strict blocking until further intelligence emerges.