pengu-event[.]app

pengu-event.app is a cryptocurrency phishing domain that has been taken down but was previously flagged by two out of 94 vendors on VirusTotal as malicious. The domain is also listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, indicating its involvement in fraudulent activities targeting cryptocurrency users.

The domain was registered with NICENIC INTERNATIONAL GROUP CO., LIMITED and hosted on an IP address managed by CloudFlare, Inc., located in Canada. The SSL certificate was issued by Let's Encrypt, which is commonly used by both legitimate and malicious sites due to its free and automated nature. The page title "Just a moment..." suggests that the site may have employed tactics to delay user interaction, potentially to load malicious scripts or redirect users to phishing pages.

Despite its current offline status, pengu-event.app exemplifies the persistent threat of cryptocurrency phishing scams. The presence of the domain on multiple blocklists and its detection by security vendors underscore its malicious intent. Such domains often exploit the gap between registration and detection by antivirus databases, making early identification crucial in preventing user compromise. PhishDestroy's proactive measures ensure that threats like pengu-event.app are identified and neutralized before they can cause significant harm.