authentise[.]cyou

This domain, authentise.cyou, is flagged as a credential harvesting phishing site targeting users through fake login portals. Analysis indicates an elevated risk level due to its recent creation, lack of encryption, and active detection by multiple security engines. The domain was taken offline following identification, but its infrastructure and registration details warrant continued monitoring for potential resurgence or related campaigns. Infrastructure analysis reveals the domain was registered on October 20, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive domains. It resolves to IP address 172.67.164.80, part of AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate malicious infrastructure. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user credentials. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, with detections spanning phishing, fraud, and generic threat categories. It appears on at least one security blocklist and was proactively blocked by PhishDestroy prior to takedown. Mitigation steps for organizations and end users include immediate blocking of the domain and its associated IP (172.67.164.80) at the network perimeter. Security teams should monitor for related domains registered through the same registrar or resolving to identical infrastructure, particularly those leveraging Cloudflare’s network. End users should be advised to avoid entering credentials on unencrypted sites and to verify domain authenticity before submitting sensitive information. If credentials were entered on this domain, password resets and multi-factor authentication reviews are recommended for all potentially affected accounts. Network logs should be reviewed for connections to the domain or IP to identify compromised systems.