unicredit-login[.]one

This domain is flagged as a high-risk credential phishing threat targeting UniCredit customers. Analysis indicates the infrastructure is designed to harvest banking login credentials through a fraudulent login portal titled 'UniCredit - Početna,' suggesting a focus on users in Croatian or Bosnian markets. The domain poses an immediate risk of financial fraud, account takeover, and unauthorized transactions if credentials are entered. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3, hosted on AS202412 (Omegatech LTD) in the Netherlands. It was registered via DYNADOT LLC on May 29, 2026, an anomalous future date likely indicating falsified registration details. The SSL certificate is issued by Let's Encrypt (YR1), a common tactic to appear legitimate. VirusTotal detection shows 22 out of 95 security vendors flag the domain as malicious, and it appears on at least one security blocklist. The page title 'UniCredit - Početna' matches the legitimate bank’s branding, increasing the likelihood of successful deception. To mitigate this threat, affected organizations and users should immediately block the domain and its associated IP (188.114.96.3) at the network perimeter. Financial institutions should monitor for credential submissions from this infrastructure and force password resets for any exposed accounts. End users should verify the authenticity of banking portals by checking for HTTPS, official domain names, and direct navigation via bookmarked or trusted links. Suspicious login pages matching this domain should be reported to the legitimate financial institution’s fraud team for further investigation and takedown.