penguinonsoi[.]com

The domain penguinonsoi.com was registered on 27 February 2026 through NiceNIC International Group Co., Limited. It resolves to the Cloudflare edge address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., placing the host within a US‑based mitigation network. An HTTP 301 redirect is observed, and the TLS certificate presented is issued by Let’s Encrypt (E8). The visible page title reads “Even geduld…”, but no further content has been analysed publicly. The site is currently listed on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that 2 of 95 scanning engines have flagged the domain, indicating at least minimal detection by external services. The Gridinsoft trust score stands at 0 out of 100, reinforcing the low reputation of the host. Nameserver records point to edna.ns.cloudflare.com and kevin.ns.cloudflare.com, confirming the continued use of Cloudflare’s DNS infrastructure. Defenders should treat penguinonsoi.com as a high‑risk generic phishing host. Immediate actions include adding the domain and its associated IP address (188.114.96.3) to network deny lists, updating URL filtering policies, and ensuring that endpoint protection suites reference the current blocklist entries. Continuous monitoring of TLS certificate changes and DNS record modifications is advised, as the infrastructure could be leveraged for further credential‑ harvesting campaigns. Organizations should also educate users about unsolicited communications that may reference the “Even geduld…” title or related linguistic cues.