invengeon[.]net

This domain, invengeon.net, was registered on 26 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare infrastructure (IP 172.67.162.176, nameservers aurora.ns.cloudflare.com and terry.ns.cloudflare.com). The site returns an HTTP 302 redirect and serves a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS endpoint. Content analysis of the page title reveals “Machine Shop | United States | Invengeon”, and technology fingerprinting identifies Wix, React, Lodash and HSTS, which are typical of low‑cost website builders often abused for credential‑harvesting pages. The threat is classified as a brand‑impersonation phishing campaign; the page likely attempts to lure victims by mimicking a legitimate “Invengeon” machine‑shop service. VirusTotal scans show 5 of 91 security vendors flagging the domain, while AlienVault OTX lists four pulses referencing it, and the domain appears on one public blocklist. It is currently listed as active, with a high risk rating, and has been blocked by the PhishDestroy sinkhole. The low Gridinsoft trust score of 0/100 further suggests malicious intent. Uncertainty remains around the exact payload delivered after redirection and whether any credential‑collection forms are present, as no visual inspection has been performed. Defenders should add invengeon.net to URL filtering and intrusion‑prevention rules, monitor DNS queries for the resolved IP, and enforce TLS inspection to capture the redirected content. Continuous re‑scanning on multi‑engine platforms is advised to capture any changes in vendor detections.