montreal1[.]authyv[.]xyz

montreal1.authyv.xyz is currently classified as a high‑risk brand‑impersonation site targeting Adobe. The domain is active as of 12 July 2026 and is listed under the scam type “Impersonation (adobe)”. The publicly observed page title is “搜索 - Microsoft 必应”, indicating a Chinese‑language Bing search page, but no additional content has been captured. The domain resolves to the IPv4 address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc. Authoritative nameservers are khloe.ns.cloudflare.com and stanley.ns.cloudflare.com, confirming Cloudflare DNS hosting. Traffic is delivered through Azure Front Door and Azure services, and the site advertises HTTP/3 support with HSTS enabled. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming a valid certificate chain despite the malicious intent. An HTTP 301 response is observed, redirecting any request to the same host. Reputation metrics are uniformly negative. Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports 5 of 95 security vendors flagging the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Registration data shows creation on 29 February 2020 through NameSilo, LLC, with no further registrar changes. No additional infrastructure such as command‑and‑control servers or payloads has been disclosed. Defenders should add montreal1.authyv.xyz to network‑level deny lists and enforce DNS sink‑hole policies for the associated IP address and both Cloudflare nameservers. Monitoring of HTTP traffic for 301 redirects to this host can help identify compromised clients. Because the page content has not been publicly archived, analysts should treat any request to the domain as potentially credential‑harvesting until further evidence is obtained. Continuous re‑evaluation is advised as new telemetry becomes available.