app-unipeg[.]com

PhishDestroy identifies app-unipeg.com as a recently activated domain posing as a Pegasis educational login portal, currently under investigation for credential phishing activities. The domain remains active and unresolved for definitive classification, warranting heightened user vigilance. All indicators suggest an emerging threat requiring immediate scrutiny. This domain was flagged by 1 of 95 VirusTotal vendors during initial scans, indicating limited detection coverage despite its active status. It resolves to IP 188.114.96.3, registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 01, 2026. The domain’s SSL certificate, issued by Let’s Encrypt, adds superficial legitimacy while lacking historical trust data. With no blocklist entries and pristine reputation scores at this stage, the absence of detections underscores the stealthy nature of this campaign. The current status remains active, with no confirmed associations to known threat actors or campaigns. Users are advised to avoid accessing app-unipeg.com or entering any credentials, even if the portal appears functional. Organizations should implement DNS-level blocking for this domain and its IP, while educating users to verify login URLs against official sources. Security teams should monitor for related domains or IPs sharing infrastructure with 188.114.96.3. Report any observed interactions with this domain to your incident response team for further analysis.