uni-dex[.]net

This domain, uni-dex.net, was observed hosting a banking phishing page that presented the title “Bank of America | Online Banking | Log In | User ID”. The site was registered through Hosting Concepts B.V. d/b/a Registrar.eu and the domain creation date is 03 March 2025. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain uses Cloudflare authoritative nameservers (justin.ns.cloudflare.com and tani.ns.cloudflare.com) and does not present an SSL certificate, indicating an unencrypted HTTP service at the time of analysis.

The infrastructure was flagged by multiple security products: it appears on one public blocklist, received a Gridinsoft trust score of 0 out of 100, and is listed as blocked by PhishDestroy. AlienVault OTX includes the domain in sixteen threat‑intelligence pulses, and VirusTotal recorded sixteen detections out of ninety‑five scanned vendors. The page impersonates the “across” brand, as indicated in the supplied intelligence, and is classified as a banking phishing campaign. The current operational status is offline, which suggests the phishing kit has been taken down or the hosting service has been suspended.

However, the underlying registration and hosting details remain active, and the same IP address may be reused for future malicious deployments. Defenders should add uni‑dex.net to URL filtering and DNS block lists, monitor for any re‑appearance of the domain or related sub‑domains, and consider flagging the associated Cloudflare IP range if broader mitigation is required. Continuous observation of the registrar’s new registrations and of Cloudflare‑hosted domains that resolve to the same IP can help detect repeat abuse. The lack of an SSL certificate and the low trust scores further corroborate the malicious intent, and the presence on multiple intelligence feeds underscores the need for proactive blocking.