sanderunion[.]club

This domain is flagged as a high-risk generic phishing threat. Analysis of the known intelligence indicates the domain was registered on June 15, 2026, through Dynadot Inc, a registrar that does not inherently indicate malicious intent but is used by both legitimate and fraudulent actors. The domain resolves to IP address 31.56.229.111, and the server software is identified as Nginx. The SSL certificate is issued by FASTPANEL, a common control panel certificate not tied to a specific trusted certificate authority. The page title retrieved is 'Buffalo, New York — City of Good Neighbors', which appears unrelated to the domain name and may be a placeholder or part of a deceptive landing page. VirusTotal data shows 21 out of 95 security vendors flagging this domain as malicious, providing strong consensus among detection engines. AlienVault OTX lists the domain in 15 threat intelligence pulses, and it appears on 2 security blocklists. The Gridinsoft trust score is 0 out of 100, further indicating low trustworthiness. The domain has been blocked by PhishDestroy and BLP-Malware. Currently, the domain remains active, meaning the phishing infrastructure is still operational. Defenders should treat sanderunion.club as a confirmed phishing domain, block all traffic to it at network and email gateways, and monitor for any outbound connections to the IP 31.56.229.111. The exact target brand or victim sector is not identified from the available data, so no specific brand impersonation can be confirmed. The page title referencing Buffalo, New York, may be a decoy or part of a localized campaign. Given the high detection rate and active status, immediate blocking and reporting to relevant threat intelligence feeds are recommended.