authenticvideoaid[.]sbs

This domain, authenticvideoaid.sbs, operates as a fraudulent video guide platform designed to deceive users into interacting with malicious crypto-related content. Analysis indicates the site likely functions as a crypto drainer or credential harvester, tricking visitors into connecting wallets or entering sensitive information under the guise of personalized video assistance. The Italian-language page title, 'La Tua Guida Video Personalizzata,' suggests targeting of Italian-speaking users, while the underlying infrastructure points to automated fraud operations rather than legitimate services. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on May 27, 2024, through Dynadot LLC, a registrar frequently abused for phishing campaigns. Security vendors on VirusTotal flagged it 14 out of 95 times, with detection engines specifically identifying it as a crypto scam. It resolves to IP address 172.67.161.109, hosted behind Cloudflare, which is commonly used to obfuscate malicious origins. The domain appears on three security blocklists and holds a Gridinsoft trust score of 0/100, further confirming its fraudulent nature. The Let's Encrypt SSL certificate, while providing encryption, does not validate legitimacy, as threat actors routinely use free certificates to appear trustworthy. Users who visited authenticvideoaid.sbs should take immediate action to mitigate risks. Disconnect any wallets or accounts linked during the visit, as the site may have executed unauthorized transactions or captured credentials. Scan the device with updated security tools to detect potential malware or browser-based threats. Monitor financial accounts and wallet activity for unauthorized transfers, especially if crypto assets were involved. Reset passwords for any accounts accessed while the site was open, using strong, unique credentials and enabling multi-factor authentication. Report the domain to relevant security teams and consider notifying local cybercrime units if financial loss occurred. Given the domain's current offline status, remain vigilant for similar scams using slight variations of the name or infrastructure.