app[.]kyunitybnkp[.]com

The domain app.kyunitybnkp.com was registered on February 21, 2026 through Dynadot Inc. It resolves to the IPv4 address 198.23.141.202, which belongs to AS36352 hosted by HostPapa in the United States. HTTP requests return status code 200 and the page title reported by scanners is “KeyUnity Bank Plc – Dedicated to innovating, simplifying, and humanizing digital”. The site is classified as a brand‑impersonation campaign targeting the “across” brand and is associated with a cryptocurrency‑draining scam.

Infrastructure analysis shows the domain uses the authoritative nameservers 5014.ns1.abovedomains.com and 5014.ns2.abovedomains.com. The SSL certificate is rated R10, indicating a low trust level, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that 3 out of 95 security vendors have flagged the domain as malicious. The domain appears on a single security blocklist and is blocked by the PhishDestroy service, confirming that at least one mitigation platform has taken action.

Evidence points to a high‑risk phishing operation. The combination of a recently created domain, a low‑trust SSL certificate, a near‑zero Gridinsoft score, and multiple vendor detections suggest active abuse. The page title explicitly references KeyUnity Bank Plc, aligning with the reported brand‑impersonation target. However, the exact malicious payload, user‑facing content, and any credential‑harvesting mechanisms have not been publicly disclosed, leaving the full scope of the campaign uncertain.

Defenders should block the domain at DNS and network layers, monitor outbound connections to 198.23.141.202, and enforce strict email filtering for messages containing references to KeyUnity Bank Plc or cryptocurrency offers. Continuous re‑evaluation is advised as additional indicators may emerge, especially if the site begins serving malware or redirects victims to cryptocurrency wallets.