univestplus[.]com

Analysis indicates that univestplus.com was registered on 24 May 2026 through GoDaddy, LLC and is currently active. The domain is served by GoDaddy’s default nameservers ns17.domaincontrol.com and ns18.domaincontrol.com and presents a GoDaddy‑issued TLS certificate (GoDaddy TLS Intermediate CA DV – R1v1). DNS resolution points to the single IPv4 address 76.223.105.230. No additional infrastructure such as CDN or redirection services is observable from the available data. The registration date, the use of a generic commercial SSL certificate, and the lack of any known brand affiliation suggest the domain was created for a short‑term malicious campaign. The threat type is identified as generic phishing, implying attempts to harvest user credentials or personal data. Concrete evidence of malicious payloads, hosting of phishing pages, or phishing email distribution is not present in the current intelligence set, leaving the operational details uncertain. Defenders should treat the domain as high‑risk until further forensic evidence is obtained: block network traffic to the IP address, add the domain to URL filtering lists, and monitor for any outbound connections or credential submissions targeting the domain. Continuous re‑inspection of the site’s content and any associated URLs is recommended to confirm the presence of phishing pages and to update detection rules accordingly.