focusunion[.]online

The domain focusunion.online is a confirmed phishing site engaged in brand impersonation targeting the financial services brand 'across'. It presented itself as a legitimate portal under the page title 'Focus Union - Personal | Business' but was designed to harvest user credentials through deceptive login forms. No crypto drainer kit was detected. As of the latest verification, focusunion.online has been taken offline, though prior activity classified it as an elevated-risk threat.

Technical analysis shows focusunion.online was flagged by 2 of 95 VirusTotal security vendors, including CRDF and Gridinsoft, which assigned a trust score of 0/100. The domain appeared on 1 security blocklist (PhishDestroy) and was registered through NameSilo, LLC on June 27, 2025. It resolved to the IP address 74.50.67.3, hosted by Interserver, Inc in the US, with no SSL certificate issued. Scamadviser assigned a low trust score of 26/100, and Google Safe Browsing did not flag the domain at the time of assessment. The domain used a single nameserver configuration.

Users who interacted with focusunion.online should immediately change any passwords entered on the site, particularly for financial or cryptocurrency-related accounts. Enable two-factor authentication (2FA) on all sensitive services to prevent unauthorized access. Monitor accounts for suspicious transactions or login attempts and report any fraudulent activity to the impersonated brand, 'across'. The domain can be reported to anti-phishing organizations such as PhishTank or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts.