redirectpengu[.]pages[.]dev

Redirectpengu.pages.dev is currently active and employs redirection tactics to deceive users. This domain is flagged as malicious by 1 out of 92 vendors on VirusTotal, indicating a low level of detection but a confirmed threat. The domain is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, highlighting its recognition as a threat across multiple platforms.

The domain is registered via Cloudflare Pages and hosted on an IP address located in Canada, under the organization Cloudflare, Inc. This infrastructure choice suggests a strategy to leverage reputable services to mask malicious intent. The SSL certificate is issued by Google Trust Services, which could be an attempt to appear legitimate and secure to unsuspecting users.

Despite the low detection rate on VirusTotal, the presence of redirectpengu.pages.dev on multiple blocklists signifies its active use in malicious campaigns. Phishing domains like this often exploit the gap between domain registration and antivirus database updates, making early detection crucial. PhishDestroy's detection pipeline captures these threats during this critical window, ensuring timely identification and mitigation.