cunionbk[.]com[.]flonexb[.]com

Analysis of cunionbk.com.flonexb.com shows that the domain was created on April 16, 2025 and is currently taken offline. The site was hosted on IP 198.12.66.123, which belongs to AS36352 operated by HostPapa in the United States. DNS resolution used the authoritative name servers ns1.host-forest.com and ns2.host-forest.com. The domain was registered through Cosmotown, Inc., and the TLS certificate was issued by Let’s Encrypt (R13), indicating use of an automated certificate authority.

The web server advertised HTTP/3 support, suggesting a modern web stack. Page metadata revealed the title “Credit Union – Dedicated to innovating, simplifying, and humanizing digital bank,” which aligns with a brand‑agnostic financial‑service narrative but the listed impersonated brand is “across,” and the scam type is identified as a crypto scam. Security assessments show a Gridinsoft trust score of 0 / 100 and three of ninety‑five VirusTotal scanners flagged the domain as malicious. The domain appears on one external security blocklist and was blocked by the PhishDestroy sinkhole, confirming active abuse.

While the site is no longer reachable, the infrastructure components—HostPapa hosting, Let’s Encrypt certificate, and HTTP/3 configuration—remain observable and could be reused in future campaigns. Defenders should continue to monitor the IP address 198.12.66.123 and the associated name servers for re‑appearance of malicious content, update URL filtering to include cunionbk.com.flonexb.com, and consider adding the domain to internal blocklists. Threat intelligence feeds should note the association with an “across” brand impersonation and crypto‑scam tactics to aid correlation with similar future artifacts.