new-autha[.]cyou

PhishDestroy identifies new-autha.cyou as an active credential harvesting phishing domain posing an elevated threat to users. This domain mimics legitimate authentication portals to trick victims into surrendering credentials.

This domain was flagged by 1 out of 95 VirusTotal security vendors and is already blocked by MetaMask and SEAL. It resolves to IP address 62.77.158.10, was registered on April 28, 2026 through Dynadot LLC, and has appeared on 2 separate blocklists. The site uses a Let’s Encrypt SSL certificate to appear trustworthy, but its recent creation date and blocklist presence underscore its malicious nature.

Users should treat this domain as compromised and avoid interacting with it entirely. Organizations should block new-autha.cyou at DNS and firewall levels. If credentials were entered, users must immediately reset passwords and enable multi-factor authentication. Security teams should monitor for any signs of credential misuse or lateral movement within their environment.