my-auth[.]com

PhishDestroy identifies my-auth.com as an active credential-harvesting domain designed to steal login credentials for major services. This site mimics legitimate authentication pages to trick users into entering usernames, passwords, or multi-factor codes. When victims submit their data, it is immediately captured by attackers and used for unauthorized account access or sold on dark web markets. The domain lacks original content and instead relies on cloned login interfaces, making it highly deceptive to unsuspecting visitors. my-auth.com poses an elevated risk due to its current operational status and rapid deployment timeline.

This domain was flagged by 19 out of 95 VirusTotal security vendors, indicating substantial malicious detection. It was registered on June 24, 2025 through GoDaddy.com, LLC using a Let's Encrypt SSL certificate for added legitimacy. The site resolves to IP address 185.163.85.65, a hosting infrastructure recently linked to multiple phishing campaigns targeting financial and SaaS login portals. The combination of recent registration, high detection rate, and active hosting suggests this is part of a coordinated fraud campaign rather than an isolated incident.

If you visited my-auth.com or entered any login credentials, immediately change passwords on all affected accounts and enable two-factor authentication. Scan your device with reputable antivirus software to detect any installed malware or keyloggers. Report the domain to your IT team or use browser-based reporting tools provided by your security platform. Avoid any future interaction with this domain and warn others who may have been targeted. Act quickly—credentials exposed today can be exploited within hours by cybercriminals.