santunion[.]club

PhishDestroy has identified santunion.club as a generic phishing domain that impersonates Santander Bank, attempting to harvest personal banking credentials. The site's page title, 'Оnlinе Ваnk Ассоunt | Реrsоnаl Ваnking | Sаntаndеr Ваnk - Sаntаndеr,' uses Cyrillic homoglyphs to evade detection while mimicking the legitimate Santander online banking portal. No specific drainer kit was identified, but the domain's structure and content strongly suggest credential theft as the primary objective.

Technical indicators reveal a high-risk profile. VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious, indicating widespread detection. The domain was registered on June 14, 2026, through DYNADOT LLC, a registrar known for minimal abuse prevention. It resolves to IP address 31.56.229.111 and uses a Let's Encrypt SSL certificate (YR1), which is common among phishing sites due to its free issuance. The domain appears on one security blocklist and is not listed on Google Safe Browsing (GSB), though its offline status may affect GSB data.

Currently, santunion.club is offline, indicating that hosting providers or authorities have taken action to disrupt the phishing operation. However, the domain remains registered and could potentially be reactivated or redirected. Users who may have visited the site should immediately change their Santander credentials and enable multi-factor authentication. PhishDestroy recommends monitoring financial accounts for unauthorized activity and reporting any suspicious transactions. Continued vigilance is advised as similar phishing campaigns often re-emerge under different domains.