verify[.]discauth[.]pro

The domain verify.discauth.pro is currently active and has been classified as a credential phishing site. It was registered on 2026-04-03 and began resolving to the IP address 104.21.72.128 shortly thereafter. The site returns an HTTP 403 status code and displays a page titled “Just a moment…”, which is typical of Cloudflare‑protected pages that hide the underlying content.

Infrastructure analysis shows the domain is hosted behind Cloudflare’s network in Canada, as indicated by the IP location. The authoritative nameservers are ulla.ns.cloudflare.com and aarav.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The SSL certificate is issued by Let’s Encrypt (E7), providing valid TLS encryption but offering no insight into the payload.

Threat intelligence sources assign a Gridinsoft trust score of 0 out of 100, indicating a high confidence of malicious intent. VirusTotal has flagged the domain in six out of ninety‑five scanned security engines, and the domain appears on a single public blocklist. PhishDestroy has already blocked the domain, suggesting that it is being actively used in phishing campaigns targeting credential harvest. The combination of a low trust score, multiple vendor detections, and the presence on a blocklist provides concrete evidence of its malicious nature, even though the actual phishing page cannot be observed due to the 403 response.

Defenders should immediately add verify.discauth.pro to outbound and inbound blocklists across firewalls, web proxies, and DNS filtering solutions. Continuous monitoring of the associated IP address and the Cloudflare nameservers is advisable, as the adversary may shift hosting to other Cloudflare‑protected assets. Security teams should also alert end users to the presence of credential‑phishing attempts that may reference this domain, and enforce multi‑factor authentication to mitigate the impact of any compromised credentials.