ufz[.]oni[.]mybluehost[.]me

Analysis of ufz.oni.mybluehost.me confirms it is operating as a generic phishing site. The domain resolves to the IPv4 address 69.6.192.198, which is assigned to a hosting provider located in Spain and identified as Newfold Digital, Inc. HTTP requests receive a 302 redirect, and the site presents the page title “Welcome — Próximamente”. The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, indicating a valid TLS handshake but offering no assurance of legitimacy. The domain was registered on October 5, 2016 through Domain.com and is served by the authoritative name servers ns1.bluehost.com and ns2.mybluehost.me. An MX record is present (mail.ufz.oni.mybluehost.me) but no additional mail infrastructure has been observed. The hosting stack includes Apache HTTP Server, PHP, MySQL, WordPress, and jQuery, which are common components for compromised or malicious sites. Threat intelligence shows the domain appears on a single security blocklist and is currently listed by PhishDestroy as a generic phishing resource. VirusTotal scans have flagged the domain in 5 out of 95 security engines, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The combination of a redirection response, a generic “Welcome” title, and the presence of widely used web platforms suggests the site is being used to host malicious content rather than legitimate services. While the external surface is well documented, the exact payload or credential‑harvesting mechanisms remain unknown because the page content has not been captured. Defenders should block network traffic to 69.6.192.198, add ufz.oni.mybluehost.me to URL filtering lists, and monitor for any email traffic directed to the hosted mail subdomain. Continuous re‑evaluation is advised in case the site changes hosting or begins serving additional malicious payloads.