discauth[.]app

This domain is flagged as a crypto credential harvester designed to steal wallet login details and private keys. Visitors were likely presented with a fake authentication portal mimicking legitimate decentralized applications, prompting them to enter sensitive credentials. The site's infrastructure was optimized for rapid credential capture and immediate fund transfer, a common tactic in crypto drainer schemes targeting users of blockchain platforms. Analysis indicates the domain was created on February 27, 2026, and registered through NiceNIC International Group Co., Limited. Despite its recent creation, the domain appeared on three security blocklists and was proactively blocked by multiple browser-based security tools. VirusTotal reported 0 out of 95 detections, suggesting the threat was either too new or sufficiently obfuscated to evade initial scanning engines. The site resolved to IP address 188.114.96.3 and utilized Cloudflare services, including HSTS and HTTP/3, to enhance performance and evade basic detection mechanisms. If you visited discauth.app and entered any credentials, wallet details, or private keys, immediate action is required. Disconnect the affected device from the internet and revoke any active wallet sessions. Transfer remaining assets to a new, secure wallet using a clean device. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where possible. Given the domain's use of Cloudflare and HSTS, users should also clear browser cache and cookies to remove any residual tracking or session data. Report the incident to relevant security teams for further analysis and potential mitigation.