unionfinancialbank[.]com

Analysis indicates that unionfinancialbank.com is an active high-risk phishing domain targeting banking credentials. The domain was registered on March 11, 2026, through Global Domain Group LLC and currently resolves to IP address 192.142.54.88, hosted on AS214036 (Ultahost, Inc.) in the Netherlands. Nameservers dns5.fimgohost.com and dns6.fimgohost.com are associated with the infrastructure, which also employs a Let's Encrypt SSL certificate (R13) to present a secure connection. The page title, 'Home - Union Financial Bank,' suggests an attempt to impersonate a legitimate financial institution, though the exact brand target remains unconfirmed without further content analysis. Detection data from security vendors shows that 13 of 95 engines flag the domain as malicious. The domain appears on at least one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. Technologies detected on the site include PHP, Bootstrap, LiteSpeed, jQuery, and Smartsupp, which are consistent with phishing kit deployments but do not confirm a specific kit variant. Defenders should treat this domain as an active threat. The combination of recent registration, financial-themed branding, and detection by multiple security engines supports classification as a banking phishing operation. Network-level blocking of 192.142.54.88 and associated nameservers is recommended, alongside monitoring for related domains registered through the same registrar or infrastructure. Further investigation into the hosting provider and nameserver history may reveal additional linked phishing campaigns.