discord[.]authunlock[.]live

Analysis indicates that the domain discord.authunlock.live was actively serving a page titled “Just a moment…”. The site was hosted behind Cloudflare, using the nameservers ridge.ns.cloudflare.com and journey.ns.cloudflare.com, and resolved to the IP address 104.21.23.16, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented for the domain was issued by Google Trust Services under the WE1 intermediate, a certificate chain commonly used by legitimate Google services, which may have been leveraged to increase perceived legitimacy. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the infrastructure was identified as a brand‑impersonation campaign targeting Google. The page returned an HTTP 403 status code at the time of analysis, and the domain is currently offline.

Detection data show that the domain appears on three independent security blocklists and has been flagged by the PhishDestroy, MetaMask, and SEAL blocklist providers. VirusTotal recorded eight detections out of ninety‑one submitted scanners, confirming that a minority of AV engines recognized malicious behavior. No additional malicious payloads or credential‑harvesting forms were observed in the limited snapshot available, and the exact phishing kit or credential capture mechanism remains uncertain. Defenders should treat any network traffic to or from discord.authunlock.live as suspicious.

Email gateways, web proxies, and endpoint security solutions should block the domain and its associated IP address, and any existing alerts that reference the domain should be escalated for investigation. Because the domain used a legitimate‑looking Google certificate, reputation‑based controls that rely solely on certificate authorities may be insufficient; correlation with known blocklist entries and the observed HTTP 403 response provides a more reliable indicator.