auth-identity[.]me

auth-identity.me is currently classified as a high‑risk generic phishing site. The domain was registered on 2026‑06‑01 and resolves to 172.67.171.36, an address owned by Cloudflare, Inc. in Canada. HTTP requests return a 403 status and the only observable page title is “Just a moment…”. TLS is provided by a Google Trust Services certificate (WE1) and the service supports HTTP/3. Google Safe Browsing lists the domain under the SOCIAL_ENGINEERING category. VirusTotal reports three detections out of ninety‑one scanners, and AlienVault OTX references the domain in a single threat pulse. The domain is already blocked by PhishDestroy and appears on one public blocklist. Infrastructure analysis indicates the attacker is leveraging Cloudflare’s CDN to hide the true origin, making direct attribution difficult. No additional content, login forms, or targeted brand information have been disclosed, so the exact phishing campaign details remain unknown. Defenders should block the domain and its associated IP at perimeter defenses, monitor DNS queries for the host, and continue to watch for any new indicators that may emerge from the underlying server if the CDN configuration changes.