coresages[.]site

This domain, coresages.site, is identified as a credential harvesting phishing site designed to impersonate an official login portal. Visitors to the site are presented with a fraudulent login and registration interface, where entered credentials are captured by threat actors for unauthorized access to accounts, financial theft, or further malicious activity. The site specifically targets users expecting legitimate services, exploiting trust in recognizable branding or service names to facilitate credential theft. Analysis indicates that coresages.site was registered on May 28, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 163.61.188.9 and currently holds a VirusTotal detection score of 0 out of 95 security engines, suggesting it has not yet been widely flagged by automated systems. Despite this low detection rate, the domain appears on one security blocklist, indicating prior suspicion or confirmed malicious activity. The SSL certificate is issued by Let's Encrypt, a common practice among phishing sites to appear legitimate and evade browser security warnings. Users who have visited coresages.site or entered credentials on the site should take immediate action to mitigate potential risks. First, change passwords for any accounts accessed or entered on the site, prioritizing email, financial, and work-related accounts. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the respective service providers. Additionally, consider scanning the device used to access the site for malware, as phishing pages may redirect to or host malicious payloads. If financial information was entered, contact the relevant financial institution to report potential fraud and request account monitoring or freezing.