ks39dmitgq[.]scalableenterprise[.]de

This domain is flagged as a generic phishing threat with an elevated risk level, specifically designed to impersonate enterprise authentication portals for credential harvesting. Analysis indicates the domain was created on June 14, 2026, and is currently offline, though it remains a documented threat in security databases. The infrastructure resolves to the IP address 188.114.96.3, and the domain appears on at least one security blocklist. VirusTotal detection shows 5 out of 95 security vendors flagging this domain as malicious, while its SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites.

Infrastructure analysis reveals additional technical indicators: the domain was registered through an unknown registrar, which is atypical for legitimate enterprise portals. The IP address 188.114.96.3 has been associated with other low-reputation domains, suggesting a pattern of malicious hosting. The creation date of June 14, 2026, indicates either a typo-squatting attempt or a preemptive registration to evade detection before deployment. The single blocklist appearance and low VirusTotal detection rate (5/95) suggest this domain may have been operational for a limited time or employed evasion techniques to avoid widespread detection.

Mitigation steps for this threat type include immediate blacklisting of the domain and its associated IP address in enterprise security gateways. Security teams should conduct retrospective log analysis to identify any prior interactions with this domain, particularly focusing on authentication attempts or credential submissions. End-user training should emphasize the risks of entering credentials into unfamiliar portals, even if they appear to use valid SSL certificates. Additionally, monitoring for newly registered domains with similar naming patterns (e.g., random alphanumeric prefixes) can help preempt future phishing attempts targeting enterprise credentials.