authenticlearncourse[.]sbs

This domain, authenticlearncourse.sbs, operates as a credential phishing portal impersonating an educational platform. The site presents itself as "AuthenticLearnCourse: Kurse für Ihre Zukunft," targeting German-speaking users with fake course offerings designed to harvest login credentials, payment details, or personal information. Analysis indicates the domain is structured to mimic legitimate e-learning platforms, increasing the likelihood of successful social engineering attacks against individuals seeking professional development or certification programs. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 27, 2026, through Dynadot LLC, a registrar frequently associated with phishing operations. It resolves to the IP address 104.21.9.76 and is protected by Cloudflare, a common tactic to obscure hosting details and evade takedowns. The domain appears on three security blocklists and is flagged by 15 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The SSL certificate is issued by Let's Encrypt, providing a false sense of security while the site engages in fraudulent activities. The use of HTTP/3 further suggests an attempt to leverage modern protocols to bypass legacy security controls. Users who visited authenticlearncourse.sbs should take immediate action to mitigate potential compromise. If credentials or payment details were entered, reset passwords for all associated accounts, particularly those using the same or similar credentials. Monitor financial statements for unauthorized transactions and enable multi-factor authentication where available. Clear browser cache and cookies to remove any stored session data. Organizations should block the domain and its resolving IP (104.21.9.76) at the network level to prevent further access. Report the incident to relevant security teams or platforms for further analysis and potential takedown coordination.