credixaunionbank[.]com

This domain, credixaunionbank.com, is identified as a credential harvesting site targeting Union Bank customers. Analysis indicates the infrastructure was specifically designed to mimic legitimate Union Bank login portals, capturing sensitive financial credentials such as usernames, passwords, and multi-factor authentication codes. The phishing kit employed appears to be a generic credential harvester rather than a specialized crypto drainer, focusing on immediate account compromise rather than direct cryptocurrency theft. No evidence of embedded malicious JavaScript frameworks or wallet-draining scripts was observed in preliminary analysis, though deeper forensic examination would be required to rule out secondary payloads. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to IP address 74.50.80.15, which has been previously linked to multiple phishing campaigns targeting financial institutions. Detection metrics show 14 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The domain was also detected in one threat intelligence pulse on a major threat exchange platform, further corroborating its malicious nature. Google Safe Browsing status was not explicitly provided, but the low detection count suggests the campaign may have been relatively short-lived or targeted. Current status indicates the domain has been taken offline, likely in response to abuse reports or automated takedown mechanisms. The hosting infrastructure at 74.50.80.15 remains active, however, posing a residual risk for potential redeployment of similar phishing pages under different domains. While the immediate threat has been neutralized, affected users are advised to monitor financial accounts for unauthorized transactions and reset credentials through official Union Bank channels. Organizations should update security controls to block the identified IP and registrar patterns associated with this campaign, as similar infrastructure may be reused for future attacks.