sant[.]unitoni[.]com

The domain sant.unitoni.com was registered on 10 May 2026 through Squarespace Domains II LLC. Its creation date is recent, and the domain is currently classified as high‑risk with an active status. The unique seed 18ac30 links this observation to existing threat‑intel records.

The authoritative name servers are ns-1527.awsdns-62.org, ns-1790.awsdns-31.co.uk, ns-452.awsdns-56.com, and an additional AWS Route 53 server. DNS resolution points to the IPv4 address 180.178.160.153, which maps to a Telecom Services provider in Pakistan. The site presents an SSL certificate issued by Let’s Encrypt (R12), indicating a valid TLS handshake despite its malicious purpose.

An HTTP request to the site receives a 303 status code, redirecting the client without delivering a typical landing page. The only visible artifact is the HTML title tag, which reads “Le Monde.fr - Actualités et Infos en France et dans le monde”, a clear attempt to mimic the French news outlet Le Monde. This suggests the infrastructure is being used to host a credential‑harvesting page that pretends to be the legitimate news site.

VirusTotal analyses have flagged the domain by 3 out of 95 security vendors, and the Gridinsoft trust score is 0 out of 100, reinforcing the suspicion of malicious activity. The domain appears on one external blocklist and is already blocked by PhishDestroy, confirming that security‑operated entities have identified it as a threat.

Defenders should immediately block sant.unitoni.com at network perimeter and email gateways, and add the associated IP address 180.178.160.153 to deny‑list rules. Continuous DNS monitoring is advised to detect any fast‑flux or related sub‑domains that may appear under the same name servers. Users, especially French‑language audiences, should be warned not to submit credentials to any site presenting a Le Monde branding that does not match the official https://www.lemonde.fr domain.