Analysis of the domain penowex.com shows it was registered on 28 March 2026 through MAT BAO CORPORATION and is hosted on Cloudflare infrastructure, using the authoritative name servers fay.ns.cloudflare.com and guss.ns.cloudflare.com. The domain resolves to the IP address 188.114.96.3, which is part of Cloudflare's edge network and does not reveal the underlying hosting provider. VirusTotal reports that six of ninety‑one antivirus and URL‑reputation scanners have flagged the domain as malicious, indicating that a subset of security products have identified it as a phishing vector.
The domain appears on at least one public blocklist and is actively blocked by the PhishDestroy service, confirming that downstream defenses are already recognizing it as a threat. The available data does not include a page title, SSL certificate details, HTTP response codes, or any observed payload, so the exact content served by the site remains unknown. Nevertheless, the combination of recent registration, Cloudflare name‑server usage, detection by multiple vendors, and inclusion on blocklists meets the criteria for a high‑risk generic phishing operation.
Defenders should add penowex.com to URL filtering and DNS‑sinkhole policies, monitor outbound traffic for connections to 188.114.96.3, and ensure that email gateways flag any messages containing this domain. Incident response teams should also consider quarantining any credentials or session cookies that may have been submitted to the site, and threat‑intel sharing platforms should be updated with the indicators of compromise identified here.