fennia[.]2pcine[.]fun

Analysis of the domain fennia.2pcine.fun shows a short-lived infrastructure that was actively used for brand impersonation targeting Google. The domain was registered on March 31, 2025 through HOSTINGER operations, UAB and is hosted on the IP address 62.60.226.175, which resolves to a German location (AS214351 FEMO IT SOLUTIONS LIMITED). The authoritative name servers cris.ns.cloudflare.com and naya.ns.cloudflare.com indicate that Cloudflare DNS services were employed, yet no SSL certificate was presented for the site, leaving the HTTP connection unsecured. The page title returned by the server is "Fennia," which does not directly reference the targeted brand, but the intelligence tag explicitly marks the site as a Google impersonation case.

VirusTotal scans flagged the domain by two out of ninety‑five security vendors, suggesting that at least a subset of scanners identified malicious characteristics. The domain is listed on a single security blocklist and was specifically blocked by the PhishDestroy feed, reinforcing the perception of malicious intent. Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence in its fraudulent nature. Current operational status is offline, and the risk rating is elevated.

Defenders should continue to deny any outbound connections to the IP 62.60.226.175, enforce DNS sinkholing of the fennia.2pcine.fun name, and update relevant URL filtering and web gateway policies to include this indicator. Monitoring of the associated Cloudflare name servers for newly created sub‑domains is advisable, as threat actors often reuse the same DNS infrastructure for subsequent campaigns. Incident response teams should also correlate any internal logs that reference requests to this domain or its IP, and pursue forensic analysis of any compromised credentials that may have been harvested during the brief active period.