access[.]pengu-dapp[.]com

access.pengu-dapp.com is currently active and classified as a high‑risk generic phishing site delivering an investment‑scam payload. The domain was registered through Tucows Domains Inc. on 21 February 2026. DNS resolution points to 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative name servers, CHLOE.NS.CLOUDFLARE.COM and ROAN.NS.CLOUDFLARE.COM, are operated by Cloudflare, indicating the use of a reputable CDN service to hide the true backend infrastructure. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 label, confirming a valid TLS chain despite the malicious intent.

An HTTP request returns status code 403, suggesting that the page is intentionally restricted to certain clients or that the content is served only after specific interactions. Threat intelligence shows the page title “Even geduld…”, but the visible content has not been publicly disclosed. VirusTotal analysis recorded three positive detections out of ninety‑three scanned vendors, and the domain appears on three independent security blocklists. Defensive products PhishDestroy, MetaMask, and SEAL have already added the domain to their block lists. Independent reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification.

Defenders should immediately deny outbound connections to 188.114.97.3 and enforce domain‑level blocking for access.pengu-dapp.com across firewalls, DNS filtering, and web‑proxy solutions. Continuous monitoring of Cloudflare‑hosted IP ranges for new domains sharing the same name servers may reveal additional campaign infrastructure. Analysts should also query threat‑intel platforms for any emerging indicators of compromise related to the “Even geduld…” title and consider updating endpoint detection rules to capture the three VirusTotal‑reported signatures.