sanguen[.]courses

PhishDestroy has identified sanguen.courses as a credential theft domain designed to trick users into surrendering their login credentials. This site impersonates legitimate services to harvest usernames and passwords, which are then exploited by threat actors. The malicious domain presents a convincing replica of a well-known platform to lure victims into entering sensitive information, potentially leading to account takeovers or further compromise of linked services. This domain was flagged by 17 out of 95 security vendors on VirusTotal, indicating widespread malicious recognition. It was registered on November 1, 2025, through Dynadot Inc., a domain registrar known for both legitimate and abusive use. The domain resolves to IP address 145.223.118.108 and has been blocked by Maltrail, a reputable threat intelligence platform, further confirming its malicious nature. If you have visited sanguen.courses or entered any credentials, immediately change your passwords on the affected platform and enable multi-factor authentication where available. Scan your device for malware using trusted security software and monitor accounts for suspicious activity. Avoid clicking on unsolicited links and verify websites by checking for HTTPS, correct domain spelling, and official branding. Report any suspicious activity to your IT security team or the platform being impersonated.