cunionbk[.]com

On 24 July 2026, security analysts examined the domain cunionbk.com, which was created on 15 August 2025 through Global Domain Group LLC and currently resolves to the IP address 198.12.66.123 hosted by AS36352 (HostPapa) in the United States. The domain is served via HTTP/3 and presents a TLS certificate issued by Let’s Encrypt (R13). The page title observed before takedown reads “Credit Union – Dedicated to innovating, simplifying, and humanizing digital bank”, while the domain is classified as a crypto‑scam that impersonates the financial brand “across”. VirusTotal reports that four of ninety‑five scanners flagged the domain, and Gridinsoft assigned a trust score of 0 / 100.

The site appears on a single external blocklist and is explicitly blocked by PhishDestroy. AlienVault OTX lists the IP in one threat‑intel pulse, indicating prior malicious activity. Scamadviser rates the domain at 46 / 100, reflecting a moderate reputation concern. The domain’s hosting infrastructure, registrar, and TLS configuration are consistent with other low‑reputation phishing infrastructure.

Because the site is now offline, content verification is limited, and the exact phishing kit or payload remains unknown. Defenders should continue to block the IP 198.12.66.123 and the domain cunionbk.com at DNS and proxy layers, monitor for re‑registration or similar look‑alike domains using the same registrar or nameservers ns1.host‑forest.com / ns2.host‑forest.com, and incorporate the observed SSL fingerprint into TLS inspection rules. Additionally, organizations that use the “across” brand should alert users to the fraudulent credit‑union narrative and enforce multi‑factor authentication for any credential‑entry points. Ongoing threat‑intel feeds should be queried for any resurgence of the associated OTX pulse or new detections from the four VirusTotal scanners.