bankunited[.]site

PhishDestroy identifies bankunited.site as an active banking trojan domain impersonating BankUnited, a regional financial institution. The domain is currently under investigation while threat actors refine its deployment. The site remains live with no current blocklist presence, suggesting an early-stage campaign with potential for rapid escalation. This domain was flagged by 15 of 95 VirusTotal vendors as of the latest scan, indicating it has not yet been widely detected by security engines. It was registered through NameSilo, LLC, resolves to IP address 37.49.229.75, and was created on April 29, 2024. The threat actor leveraged a Let's Encrypt SSL certificate to enhance legitimacy and evade browser warnings. At this time, PhishDestroy has not recorded any blocklist entries or trust scores for this domain, placing it in a preliminary phase of operation. While the current detection rate is low, the domain exhibits multiple red flags: it impersonates a known banking brand, uses a recently registered domain, and employs a free SSL certificate common in phishing campaigns. Users are strongly advised to avoid interacting with any links or content from bankunited.site. Organizations and individuals should update browser and email filters to block the domain and IP address. Security teams are recommended to monitor for associated infrastructure and report any observed traffic to threat intelligence platforms. Given the volatility of phishing campaigns, this domain’s status should be re-evaluated daily until robust detection signatures are available.