sanctum-update[.]live

The domain sanctum-update.live was registered on May 01, 2026 by NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active as of July 12, 2026. It is classified as a high‑risk credential‑phishing operation. The domain’s lifecycle is short, and its recent creation aligns with the emergence of a targeted credential‑theft campaign.

Infrastructure analysis shows the zone is delegated to two authoritative name servers hosted by a major DNS provider. The domain resolves to the IP address 172.67.156.52, which belongs to a large content‑delivery network with edge nodes in Canada. TLS negotiation presents a certificate issued by a publicly trusted ACME authority (identifier E8), and HTTP requests return a 403 status code, indicating deliberate access denial for unauthenticated callers. Independent scoring assigns a trust value of zero out of one hundred, and the domain appears on a single security blocklist.

Threat‑intel correlation reveals that the domain is referenced in one open‑source threat‑exchange pulse and that four of ninety‑five scanning engines have flagged it as malicious. No additional attribution such as malware kits or known attacker groups is presently available, leaving the precise phishing lure and credential targets uncertain. The registrar information is limited to the corporate entity listed, with no further public contact details.

Given the high‑risk rating and observable indicators, defenders should block DNS resolution for sanctum-update.live at the network perimeter, monitor outbound connections to its resolved IP, and enforce web‑proxy filtering to intercept any HTTP 403 responses. Security teams should also alert users to avoid entering credentials on sites linked to this domain and consider adding the domain to internal threat‑intel feeds to improve detection across endpoint and email security solutions. Continuous re‑evaluation is advised, as additional indicators may emerge from broader telemetry collections.