sabges[.]top

This domain, sabges.top, is actively engaged in credential theft by impersonating a legitimate Service Portal interface. Analysis indicates the site is designed to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication tokens, through deceptive login prompts and fake authentication workflows. The infrastructure mimics corporate or cloud-based service portals, increasing the likelihood of successful compromise for users unfamiliar with the legitimate domain structure of their organization's service platforms.

Infrastructure analysis reveals the domain was registered on May 10, 2026, through NameSilo, LLC, a registrar frequently associated with malicious activity due to its low barrier to entry and anonymity features. As of the latest assessment, the domain appears on one security blocklist and is flagged by 22 out of 95 security vendors on VirusTotal, indicating a high confidence level in its malicious nature. The page title, 'Service Portal,' further corroborates the intent to deceive users into believing they are accessing a trusted internal or third-party service portal.

Users who have visited sabges.top or entered credentials on this domain should immediately revoke any active sessions tied to the compromised account, reset passwords using a separate, trusted device, and enable multi-factor authentication if not already active. Organizations should block the domain at the network perimeter and monitor for signs of lateral movement or unauthorized access originating from credentials harvested via this domain. Security teams are advised to review logs for connections to sabges.top and correlate any authentication attempts with this domain to identify potentially compromised accounts.